EUVD-2026-62505
GHSA-5cjr-mxj5-wmrx
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-facing SAML endpoint verifies attacker messages pre-auth with low complexity (AV:N/AC:L/PR:N/UI:N); impact is resource-exhaustion availability only, so C:N/I:N/A:H.
Primary rating from Vendor (https://github.com/simplesamlphp/saml2).
CVSS VectorVendor: https://github.com/simplesamlphp/saml2
Lifecycle Timeline
1DescriptionCVE.org
Summary
This library turned out to be vulnerable to Denial-of-Service attacks using XPath transforms. A mitigation has been put in place to restrict the number of transforms and to restrict transforms to only the transform-algorithms mentioned in the SAML 2.0 Core Specifications (and specifically refuse XPath transforms).
Impact
An attacker is able to send specially crafted messages to any entity relying on SimpleSAMLphp (or directly on this SAML2-library) to be able to perform a Denial-of-Service attack.
AnalysisAI
Denial-of-service in the simplesamlphp/saml2 PHP library (and its saml2-legacy variant, used by SimpleSAMLphp) allows unauthenticated remote attackers to exhaust CPU/memory by submitting SAML messages containing malicious XPath transforms in XML Signature elements. The fix restricts the number of transforms and rejects XPath transforms entirely, permitting only the transform algorithms named in the SAML 2.0 Core specification. No public exploit has been identified at time of analysis and the flaw carries CVSS 7.5 (availability-only impact); it is not in CISA KEV.
Technical ContextAI
The affected component is the SAML2 message-handling library for PHP distributed via Composer as simplesamlphp/saml2 and simplesamlphp/saml2-legacy, which underpins the widely-used SimpleSAMLphp identity/service-provider software. SAML assertions and protocol messages are XML documents protected by XML Signature (XML-DSIG), whose <ds:Transforms> element can specify processing steps applied before digest calculation. One optional transform algorithm is XPath (http://www.w3.org/TR/1999/REC-xpath-19991116), which lets the signer embed an arbitrary XPath expression evaluated against the document. Because XPath evaluation over attacker-controlled expressions and node sets can be computationally expensive, and multiple transforms can be chained, an attacker can craft signatures whose verification consumes disproportionate resources. This maps to CWE-400 (Uncontrolled Resource Consumption): the library did not bound the number of transforms nor restrict transform algorithms, so untrusted input dictated the amount of processing work performed during signature verification.
RemediationAI
Patch available per vendor advisory: upgrade simplesamlphp/saml2 (and simplesamlphp/saml2-legacy where used) to the patched release identified in GHSA-5cjr-mxj5-wmrx via 'composer update simplesamlphp/saml2', and update SimpleSAMLphp itself so it pulls the fixed library. The exact fixed version number was not included in the provided data - obtain it from https://github.com/simplesamlphp/saml2/security/advisories/GHSA-5cjr-mxj5-wmrx before pinning. The upstream fix works by capping the number of signature transforms and refusing XPath transforms, allowing only the transform algorithms in the SAML 2.0 Core specification. Where immediate patching is not possible, compensating controls include placing rate limiting or a WAF in front of SAML assertion-consumer and metadata endpoints to cap request volume and body size (trade-off: may throttle legitimate bursty logins), and constraining verification CPU/memory via PHP execution limits or request timeouts (trade-off: could truncate legitimate large but valid messages); these reduce but do not eliminate the resource-exhaustion window and are not substitutes for the library fix.
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today