RubyGems Package Vulnerabilities
Vulnerabilities associated with ruby-saml.
Packages
Clear package- actionpack63 vulnerabilities
- nokogiri59 vulnerabilities
- rack50 vulnerabilities
- rubygems-update25 vulnerabilities
- activerecord23 vulnerabilities
- puppet23 vulnerabilities
- activesupport17 vulnerabilities
- camaleon_cms15 vulnerabilities
- publify_core15 vulnerabilities
- rails-html-sanitizer15 vulnerabilities
- passenger14 vulnerabilities
- puma14 vulnerabilities
- actionview13 vulnerabilities
- decidim13 vulnerabilities
- fat_free_crm12 vulnerabilities
- activestorage11 vulnerabilities
- loofah11 vulnerabilities
- oj11 vulnerabilities
- rails11 vulnerabilities
- net-imap10 vulnerabilities
- ruby-saml10 vulnerabilities
- decidim-core9 vulnerabilities
- jquery-rails9 vulnerabilities
- openc39 vulnerabilities
- avo8 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2025-66568CRITICAL | ruby-saml Libxml2 Canonicalization errors can bypass Digest/Signature validationThe ruby-saml library implements the client side of an SAML authorization. Versions up to and including 1.12.4, are vulnerable to authentication bypass through the libxml2 canonicalization process used by Nokogiri for document transformation, which allows an attacker to execute a Signature Wrapping attack. When libxml2’s canonicalization is invoked on an invalid XML input, it may return an empty string rather than a canonicalized node. ruby-saml then proceeds to compute the DigestValue over this… CWE-347Dec 9, 2025 | CVSS9.3v4.0 | EPSS0.238% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-66567CRITICAL | ruby-saml has a SAML authentication bypass due to namespace handling (parser differential)The ruby-saml library is for implementing the client side of a SAML authorization. ruby-saml versions up to and including 1.12.4 contain an authentication bypass vulnerability due to an incomplete fix for CVE-2025-25292. ReXML and Nokogiri parse XML differently, generating entirely different document structures from the same input. This allows an attacker to execute a Signature Wrapping attack. This issue is fixed in version 1.18.0. CWE-347Dec 9, 2025 | CVSS9.3v4.0 | EPSS0.397% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-54572MEDIUM | Ruby SAML DOS vulnerability with large SAML responseThe Ruby SAML library is for implementing the client side of a SAML authorization. In versions 1.18.0 and below, a denial-of-service vulnerability exists in ruby-saml even with the message_max_bytesize setting configured. The vulnerability occurs because the SAML response is validated for Base64 format prior to checking the message size, leading to potential resource exhaustion. This is fixed in version 1.18.1. | CVSS6.9v4.0 | EPSS0.387% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-25292CRITICAL | Ruby SAML vulnerable to SAML authentication bypass due to namespace handling (parser differential)ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. An authentication bypass vulnerability was found in ruby-saml prior to versions 1.12.4 and 1.18.0 due to a parser differential. ReXML and Nokogiri parse XML differently, the parsers can generate entirely different document structures from the same XML input. That allows an attacker to be able to execute a Signature Wrapping attack. This issue may lead to authentication bypass. Versions 1.12.4 and 1.18.0 c… | CVSS9.3v4.0 | EPSS64.8% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-25291CRITICAL | ruby-saml vulnerable to SAML authentication bypass due to DOCTYPE handling (parser differential)ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. An authentication bypass vulnerability was found in ruby-saml prior to versions 1.12.4 and 1.18.0 due to a parser differential. ReXML and Nokogiri parse XML differently; the parsers can generate entirely different document structures from the same XML input. That allows an attacker to be able to execute a Signature Wrapping attack. This issue may lead to authentication bypass. Versions 1.12.4 and 1.18.0 f… | CVSS9.3v4.0 | EPSS20.3% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template | STIX |
CVE-2025-25293HIGH | ruby-saml vulnerable to Remote Denial of Service (DoS) with compressed SAML responsesruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Prior to versions 1.12.4 and 1.18.0, ruby-saml is susceptible to remote Denial of Service (DoS) with compressed SAML responses. ruby-saml uses zlib to decompress SAML responses in case they're compressed. It is possible to bypass the message size check with a compressed assertion since the message size is checked before inflation and not after. This issue may lead to remote Denial of Service (DoS). Versio… | CVSS7.7v4.0 | EPSS1.47% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
The Ruby SAML library vulnerable to a SAML authentication bypass via Incorrect XPath selectorThe Ruby SAML library is for implementing the client side of a SAML authorization. Ruby-SAML in <= 12.2 and 1.13.0 <= 1.16.0 does not properly verify the signature of the SAML Response. An unauthenticated attacker with access to any signed saml document (by the IdP) can thus forge a SAML Response/Assertion with arbitrary contents. This would allow the attacker to log in as arbitrary user within the vulnerable system. This vulnerability is fixed in 1.17.0 and 1.12.3. | CVSS-v4.0 | EPSS10.7% | PoCs2 | SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template | STIX | |
CVE-2015-20108CRITICAL | ruby-saml vulnerable to XPath injectionxml_security.rb in the ruby-saml gem before 1.0.0 for Ruby allows XPath injection and code execution because prepared statements are not used. CWE-77May 27, 2023 | CVSS9.8v3.1 | EPSS1.33% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2017-11428HIGH | Multiple SAML libraries may allow authentication bypass via incorrect XML canonicalization and DOM traversalOneLogin Ruby-SAML 1.6.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service providers. CWE-287Apr 17, 2019 | CVSS7.7v3.0 | EPSS2.44% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2016-5697HIGH | Ruby-saml allows attackers to perform XML signature wrapping attacksRuby-saml before 1.3.0 allows attackers to perform XML signature wrapping attacks via unspecified vectors. CWE-91Jan 23, 2017 | CVSS7.5v3.0 | EPSS1.21% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |