Resource exhaustion in Saml-Toolkits Ruby-Saml
CVE-2025-54572
The Ruby SAML library is for implementing the client side of a SAML authorization. In versions 1.18.0 and below, a denial-of-service vulnerability exists in ruby-saml even with the message_max_bytesize setting configured. The vulnerability occurs because the SAML response is validated for Base64 format prior to checking the message size, leading to potential resource exhaustion. This is fixed in version 1.18.1.
Vulnerability class: DoS (Denial of Service)
EPSS: 0.004 (32.2th percentile) — read the EPSS interpretation.
Affected products
- Saml-toolkits Ruby-saml — versions < 1.18.1
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)
- af854a3a-2127-422b-91ae-364da2661108
Frequently asked questions
- What is CVE-2025-54572?
- CVE-2025-54572 is a vulnerability in Saml-Toolkits Ruby-Saml, classified under Uncontrolled Resource Consumption. Published 2025-07-30.
- Is CVE-2025-54572 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.