CVE-2025-54572: saml-toolkits ruby-saml Uncontrolled Resource Consumption
Vulnerability summary
CVE-2025-54572 is a medium (CVSS 6.9) Uncontrolled Resource Consumption vulnerability in saml-toolkits ruby-saml. EPSS estimates a 0.40% chance of exploitation in the next 30 days, higher than 33.1% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 0 · Related 2Timeline
- 30-07-2025PublishedVulnerability first disclosed.
- 03-11-2025Last modifiedVulnerability information updated.
Description
The Ruby SAML library is for implementing the client side of a SAML authorization. In versions 1.18.0 and below, a denial-of-service vulnerability exists in ruby-saml even with the message_max_bytesize setting configured. The vulnerability occurs because the SAML response is validated for Base64 format prior to checking the message size, leading to potential resource exhaustion. This is fixed in version 1.18.1.
CVSS metrics
6 scores · 6 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
- OSV · DebianEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · ChainguardEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
- OSV · RubygemsEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
- NVDNIST6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS trend
Probability
0.40%
Chance of exploitation in the next 30 days
Percentile
33%
Versus all other CVEs
30-day change
+0.02 pp
From 0.39% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
- CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
Affected systems
Chainguard3 products
- gitlab-rails-ce-18.3< 18.3.2-r0
- gitlab-rails-ce-assets-18.3< 18.3.2-r0
- gitlab-rails-ce-doc-18.3< 18.3.2-r0
Debian1 product
- ruby-samlAll versions (No fix recorded) | < 1.11.0-1+deb11u3
RubyGems1 product
- ruby-saml< 1.18.1
Saml-toolkits1 product
- ruby-saml< 1.18.1
Ubuntu1 product
- ruby-samlAll versions (No fix recorded)
5 vendors · 7 products
References
12 links- github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-rrqh-93c8-j966X Refsource CONFIRMREPORTAdvisoryWEB
- github.com/SAML-Toolkits/ruby-saml/commit/38ef5dd1ce17514e202431f569c4f5633e6c2709X Refsource MISCREPORTFIXWEB
