CVE-2025-46784: Entrouvert Lasso DOS Vulnerability

CVE-2025-46784 Overview

A denial of service vulnerability exists in the lasso_node_init_from_message_with_format functionality of Entr'ouvert Lasso 2.5.1. This memory leak vulnerability (CWE-401) allows an attacker to send specially crafted SAML responses that cause memory depletion, ultimately resulting in denial of service. The vulnerability can be triggered remotely by sending malformed SAML response messages to affected systems.

Critical Impact
Attackers can exhaust system memory by sending malicious SAML responses, causing service disruption to applications relying on Lasso for SAML authentication and single sign-on (SSO) functionality.

Affected Products

Entr'ouvert Lasso 2.5.1
Applications using Lasso library for SAML processing
SSO implementations utilizing affected Lasso versions

Discovery Timeline

2025-11-05 - CVE-2025-46784 published to NVD
2025-11-07 - Last updated in NVD database

Technical Details for CVE-2025-46784

Vulnerability Analysis

This vulnerability is classified as a Memory Leak (CWE-401: Missing Release of Memory after Effective Lifetime). The flaw resides in the lasso_node_init_from_message_with_format function within the Entr'ouvert Lasso library, which is responsible for parsing and initializing SAML message nodes from various formats.

When processing specially crafted SAML responses, the function fails to properly release allocated memory, leading to progressive memory depletion. Since SAML is commonly used for authentication in enterprise environments, this vulnerability poses a significant risk to organizations relying on Lasso-based SSO implementations.

Root Cause

The root cause is improper memory management in the SAML message parsing logic. When lasso_node_init_from_message_with_format processes malformed SAML responses, it allocates memory buffers that are not subsequently freed when parsing errors occur or when handling certain edge cases in the message structure. This creates a memory leak condition that accumulates with each malicious request.

Attack Vector

The attack vector is network-based, requiring no authentication or user interaction. An attacker can exploit this vulnerability by:

Identifying a service endpoint that processes SAML responses using the vulnerable Lasso library
Crafting malformed SAML response messages designed to trigger the memory leak
Sending repeated requests to the target endpoint
Causing gradual memory exhaustion until the service becomes unresponsive

The vulnerability is exploitable through standard SAML authentication flows, making it accessible from the network. For detailed technical information, see the Talos Intelligence Vulnerability Report.

Detection Methods for CVE-2025-46784

Indicators of Compromise

Unusual memory growth patterns in processes utilizing the Lasso library
Increased frequency of SAML response processing requests from single sources
Out-of-memory errors or process crashes in SAML-handling services
Abnormal SAML response payloads with malformed or oversized elements

Detection Strategies

Monitor memory consumption of applications using Lasso for SAML processing and alert on sustained growth patterns
Implement rate limiting on SAML endpoints to detect and throttle potential abuse
Deploy network intrusion detection rules to identify malformed SAML responses
Enable application-level logging for SAML message parsing failures and memory allocation events

Monitoring Recommendations

Configure alerts for memory threshold violations on systems running Lasso-dependent applications
Implement SIEM rules correlating SAML endpoint activity with resource exhaustion indicators
Monitor for repeated authentication failures or parsing errors from specific source IPs
Track process restart frequency for SAML-handling services as an indicator of DoS impact

How to Mitigate CVE-2025-46784

Immediate Actions Required

Identify all systems and applications using Entr'ouvert Lasso version 2.5.1
Apply vendor patches or updates as soon as they become available
Implement network-level rate limiting on SAML authentication endpoints
Consider deploying a Web Application Firewall (WAF) with SAML message validation capabilities

Patch Information

Organizations should monitor the Talos Intelligence Vulnerability Report and Entr'ouvert's official channels for patch availability. Upgrade to a patched version of Lasso as soon as one is released.

Workarounds

Implement strict rate limiting on SAML endpoints to reduce the impact of repeated exploitation attempts
Deploy memory monitoring with automatic service restart capabilities to maintain availability during attacks
Consider placing affected services behind a reverse proxy with request validation and throttling
Restrict SAML endpoint access to known identity provider IP ranges where feasible

bash

# Example: Rate limiting SAML endpoints with nginx
# Add to your nginx server configuration
location /saml/response {
    limit_req zone=saml_limit burst=10 nodelay;
    limit_req_zone $binary_remote_addr zone=saml_limit:10m rate=5r/s;
    proxy_pass http://backend_saml_service;
}