QwikSec

Security Database

CVE

CWE

Training

CVE-2025-54572

Published: Jul 30, 2025

Modified: Nov 3, 2025

PUBLISHED

Description

The Ruby SAML library is for implementing the client side of a SAML authorization. In versions 1.18.0 and below, a denial-of-service vulnerability exists in ruby-saml even with the message_max_bytesize setting configured. The vulnerability occurs because the SAML response is validated for Base64 format prior to checking the message size, leading to potential resource exhaustion. This is fixed in version 1.18.1.

Vendor	Product	Versions
SAML-Toolkits	ruby-saml	affected `< 1.18.1`

Weaknesses (CWE)

References

https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-rrqh-93c8-j966

x_refsource_CONFIRM

https://github.com/SAML-Toolkits/ruby-saml/pull/770

x_refsource_MISC

https://github.com/SAML-Toolkits/ruby-saml/commit/38ef5dd1ce17514e202431f569c4f5633e6c2709

x_refsource_MISC

https://github.com/SAML-Toolkits/ruby-saml/releases/tag/v1.18.1

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.