CVE-2026-49289: simplesamlphp saml2 Uncontrolled Resource Consumption
Vulnerability summary
CVE-2026-49289 is a high (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in simplesamlphp saml2. EPSS estimates a 0.78% chance of exploitation in the next 30 days, higher than 55.5% of scored vulnerabilities.
Timeline
- 19-08-2026PublishedVulnerability first disclosed.
- 19-08-2026Last modifiedVulnerability information updated.
Description
The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. In 4.19.2 and 4.20.2, the library permits attacker-controlled XPath transforms while processing XML signatures in specially crafted SAML messages. XPath evaluation can consume uncontrolled processing resources, allowing a remote unauthenticated attacker to deny service to any entity relying on SimpleSAMLphp or directly on the SAML2 library. The mitigation limits the number of transforms, permits only transform algorithms identified by the SAML 2.0 Core specification, and specifically rejects XPath transforms. This issue is fixed in versions 4.19.3 and 4.20.3.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.78%
Chance of exploitation in the next 30 days
Percentile
56%
Versus all other CVEs
30-day change
+0.22 pp
From 0.56% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian1 product
- simplesamlphpAll versions (No fix recorded)
Simplesamlphp1 product
- saml2≥ 4.19.2, < 4.19.3 | ≥ 4.20.2, < 4.20.3
Ubuntu1 product
- simplesamlphpAll versions (No fix recorded)
3 vendors · 3 products
References
6 links- github.com/simplesamlphp/saml2/security/advisories/GHSA-5cjr-mxj5-wmrxX Refsource CONFIRM
