Medium severity · published Jul 30, 2025
CVE-2025-54572
Ruby SAML DOS vulnerability with large SAML response
6.9
CVSS
0.4%
EPSS
No
On KEV
Description
The Ruby SAML library is for implementing the client side of a SAML authorization. In versions 1.18.0 and below, a denial-of-service vulnerability exists in ruby-saml even with the message_max_bytesize setting configured. The vulnerability occurs because the SAML response is validated for Base64 format prior to checking the message size, leading to potential resource exhaustion. This is fixed in version 1.18.1.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RU
ruby-saml · SAML-Toolkits
< 1.18.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-54572
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-54572
github.com
https://github.com/SAML-Toolkits/ruby-saml/commit/38ef5dd1ce17514e202431f569c4f5633e6c2709
github.com
https://github.com/SAML-Toolkits/ruby-saml/pull/770
github.com
https://github.com/SAML-Toolkits/ruby-saml/releases/tag/v1.18.1
github.com
https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-rrqh-93c8-j966
lists.debian.org
https://lists.debian.org/debian-lts-announce/2025/09/msg00001.html
More from ruby-saml
9.8
CVE-2025-25292
Ruby SAML vulnerable to SAML authentication bypass due to namespace handling (parser differential)
9.8
CVE-2025-25291
ruby-saml vulnerable to SAML authentication bypass due to DOCTYPE handling (parser differential)
9.8
CVE-2024-45409
The Ruby SAML library vulnerable to a SAML authentication bypass via Incorrect XPath selector
9.1
CVE-2025-66568
ruby-saml Libxml2 Canonicalization errors can bypass Digest/Signature validation
9.1
CVE-2025-66567
ruby-saml has a SAML authentication bypass due to namespace handling (parser differential)