SB2026081949 - Multiple vulnerabilities in gosaml2

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026081949

SB2026081949 - Multiple vulnerabilities in gosaml2

Published: August 19, 2026

Security Bulletin ID SB2026081949
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 vulnerabilities.


1) Asymmetric Resource Consumption (Amplification) (CVE-ID: N/A)

CWE-ID: CWE-405 - Asymmetric Resource Consumption (Amplification)

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to asymmetric resource consumption in SAMLServiceProvider.ValidateEncodedResponse when processing a DEFLATE-compressed XML response during round-trip validation. A remote attacker can send a specially crafted SAML response containing many tiny XML elements to cause a denial of service.

A small compressed request can expand into a size-limited XML document that triggers disproportionately large memory allocation and sustained allocator and garbage-collector pressure, and concurrent requests can exhaust server memory.


2) Improper Verification of Cryptographic Signature (CVE-ID: N/A)

CWE-ID: CWE-347 - Improper Verification of Cryptographic Signature

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to forge SAML LogoutResponse messages.

The vulnerability exists due to improper verification of cryptographic signature in ValidateEncodedLogoutResponsePOST when processing a LogoutResponse with no XML signature. A remote attacker can send a specially crafted unsigned LogoutResponse to forge SAML LogoutResponse messages.

This can be used to confirm session termination that did not occur, inject arbitrary status codes and session indexes, or disrupt the single logout flow between the service provider and identity provider.


3) Input validation error (CVE-ID: N/A)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in EncryptedAssertion.DecryptBytes() when parsing a crafted SAML Response containing an EncryptedAssertion with a short or empty CipherValue in the AES-GCM or AES-CBC decryption path. A remote attacker can send a specially crafted SAML Response to cause a denial of service.

The panic occurs before signature or content validation completes, and no valid signature is required.


Remediation

Install update from vendor's website.

References