CVE-2025-46784: Entrouvert Lasso DOS Vulnerability

CVE-2025-46784 Overview

A denial of service vulnerability exists in the lasso_node_init_from_message_with_format functionality of Entr'ouvert Lasso 2.5.1. This memory leak vulnerability (CWE-401) allows an attacker to send specially crafted SAML responses that cause memory depletion, ultimately resulting in denial of service. The vulnerability can be triggered remotely by sending malformed SAML response messages to affected systems.

Critical Impact

Attackers can exhaust system memory by sending malicious SAML responses, causing service disruption to applications relying on Lasso for SAML authentication and single sign-on (SSO) functionality.

Affected Products

• Entr'ouvert Lasso 2.5.1
• Applications using Lasso library for SAML processing
• SSO implementations utilizing affected Lasso versions

Discovery Timeline

• 2025-11-05 - CVE-2025-46784 published to NVD
• 2025-11-07 - Last updated in NVD database

Technical Details for CVE-2025-46784

Vulnerability Analysis

This vulnerability is classified as a Memory Leak (CWE-401: Missing Release of Memory after Effective Lifetime). The flaw resides in the lasso_node_init_from_message_with_format function within the Entr'ouvert Lasso library, which is responsible for parsing and initializing SAML message nodes from various formats.

When processing specially crafted SAML responses, the function fails to properly release allocated memory, leading to progressive memory depletion. Since SAML is commonly used for authentication in enterprise environments, this vulnerability poses a significant risk to organizations relying on Lasso-based SSO implementations.

Root Cause

The root cause is improper memory management in the SAML message parsing logic. When lasso_node_init_from_message_with_format processes malformed SAML responses, it allocates memory buffers that are not subsequently freed when parsing errors occur or when handling certain edge cases in the message structure. This creates a memory leak condition that accumulates with each malicious request.

Attack Vector

The attack vector is network-based, requiring no authentication or user interaction. An attacker can exploit this vulnerability by:

1. Identifying a service endpoint that processes SAML responses using the vulnerable Lasso library
2. Crafting malformed SAML response messages designed to trigger the memory leak
3. Sending repeated requests to the target endpoint
4. Causing gradual memory exhaustion until the service becomes unresponsive

The vulnerability is exploitable through standard SAML authentication flows, making it accessible from the network. For detailed technical information, see the Talos Intelligence Vulnerability Report.

Detection Methods for CVE-2025-46784

Indicators of Compromise

• Unusual memory growth patterns in processes utilizing the Lasso library
• Increased frequency of SAML response processing requests from single sources
• Out-of-memory errors or process crashes in SAML-handling services
• Abnormal SAML response payloads with malformed or oversized elements

Detection Strategies

• Monitor memory consumption of applications using Lasso for SAML processing and alert on sustained growth patterns
• Implement rate limiting on SAML endpoints to detect and throttle potential abuse
• Deploy network intrusion detection rules to identify malformed SAML responses
• Enable application-level logging for SAML message parsing failures and memory allocation events

Monitoring Recommendations

• Configure alerts for memory threshold violations on systems running Lasso-dependent applications
• Implement SIEM rules correlating SAML endpoint activity with resource exhaustion indicators
• Monitor for repeated authentication failures or parsing errors from specific source IPs
• Track process restart frequency for SAML-handling services as an indicator of DoS impact

How to Mitigate CVE-2025-46784

Immediate Actions Required

• Identify all systems and applications using Entr'ouvert Lasso version 2.5.1
• Apply vendor patches or updates as soon as they become available
• Implement network-level rate limiting on SAML authentication endpoints
• Consider deploying a Web Application Firewall (WAF) with SAML message validation capabilities

Patch Information

Organizations should monitor the Talos Intelligence Vulnerability Report and Entr'ouvert's official channels for patch availability. Upgrade to a patched version of Lasso as soon as one is released.

Workarounds

• Implement strict rate limiting on SAML endpoints to reduce the impact of repeated exploitation attempts
• Deploy memory monitoring with automatic service restart capabilities to maintain availability during attacks
• Consider placing affected services behind a reverse proxy with request validation and throttling
• Restrict SAML endpoint access to known identity provider IP ranges where feasible

# Example: Rate limiting SAML endpoints with nginx
# Add to your nginx server configuration
location /saml/response {
    limit_req zone=saml_limit burst=10 nodelay;
    limit_req_zone $binary_remote_addr zone=saml_limit:10m rate=5r/s;
    proxy_pass http://backend_saml_service;
}