Skip to content
OpenAdvisories
Critical DLA-4115-1 3 CVEs

ruby-saml - security update

Published Apr 5, 2025 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 11 ruby-saml 1.11.0-1+deb11u2

Vulnerabilities 3

  • Critical 9.3
    CVE-2025-25291 EPSS 21%

    ruby-saml vulnerable to SAML authentication bypass due to DOCTYPE handling (parser differential)

    ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. An authentication bypass vulnerability was found in ruby-saml prior to versions 1.12.4 and 1.18.0 due to a parser differential. ReXML and Nokogiri parse XML differentl…

    SAML-Toolkits ruby-saml ruby-saml ruby-saml Debian Ubuntu RubyGems
  • Critical 9.3
    CVE-2025-25292 EPSS 65%

    Ruby SAML vulnerable to SAML authentication bypass due to namespace handling (parser differential)

    ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. An authentication bypass vulnerability was found in ruby-saml prior to versions 1.12.4 and 1.18.0 due to a parser differential. ReXML and Nokogiri parse XML differentl…

    SAML-Toolkits ruby-saml ruby-saml ruby-saml Debian Ubuntu RubyGems
  • High 7.7
    CVE-2025-25293

    ruby-saml vulnerable to Remote Denial of Service (DoS) with compressed SAML responses

    ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Prior to versions 1.12.4 and 1.18.0, ruby-saml is susceptible to remote Denial of Service (DoS) with compressed SAML responses. ruby-saml uses zlib to decompress SAML …

    SAML-Toolkits ruby-saml ruby-saml ruby-saml Debian Ubuntu RubyGems