CVE-2025-54572: Ruby SAML Library DoS Vulnerability

CVE-2025-54572 Overview

CVE-2025-54572 is a denial-of-service vulnerability in the ruby-saml library, which implements the client side of SAML (Security Assertion Markup Language) authorization. The flaw affects versions 1.18.0 and below. The library validates incoming SAML responses for Base64 formatting before enforcing the configured message_max_bytesize limit, allowing an unauthenticated attacker to submit oversized payloads that exhaust server resources. The issue is tracked as [CWE-400] Uncontrolled Resource Consumption and is fixed in version 1.18.1.

Critical Impact
Unauthenticated network attackers can trigger resource exhaustion on any service integrating ruby-saml 1.18.0 or earlier by sending large SAML messages, bypassing the intended size guard.

Affected Products

SAML-Toolkits ruby-saml versions 1.18.0 and below
Ruby applications using ruby-saml for SAML authentication
Debian LTS distributions shipping the vulnerable package

Discovery Timeline

2025-07-30 - CVE-2025-54572 published to NVD
2025-07-30 - Fix released in ruby-saml v1.18.1
2025-09 - Debian LTS advisory published
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54572

Vulnerability Analysis

The ruby-saml library exposes a decode_message routine responsible for handling inbound SAML responses. The routine accepts a max_bytesize parameter intended to reject oversized messages before further processing. In vulnerable versions, the function first invokes base64_encoded? on the entire incoming message and only then checks the byte size. The Base64 detection routine iterates over the full input, so an attacker submitting a very large payload forces the process to expend CPU and memory before the size guard ever executes.

This ordering defeats the purpose of the message_max_bytesize control. Repeated requests carrying multi-megabyte payloads can cause sustained CPU spikes and memory pressure on the authenticating service, degrading availability for legitimate users.

Root Cause

The root cause is an ordering flaw in input validation. The size check must occur before any content-inspection routine that scales with input length. The fix reorders the checks so that max_bytesize enforcement happens first, and the Base64 detection runs only against inputs already known to be within bounds.

Attack Vector

Exploitation requires no authentication and no user interaction. An attacker sends a crafted SAML response, typically to a Service Provider (SP) endpoint that consumes SAMLResponse parameters, containing an oversized payload. Because SAML endpoints are typically internet-facing to support single sign-on, the attack surface is broad.

ruby

#   to prevent a possible DoS attack.
# @return [String] The plain SAML Message
def decode_message(message, max_bytesize = nil)
-  return message unless base64_encoded?(message)
-
  max_bytesize ||= DEFAULT_MAX_BYTESIZE

  if message.bytesize > max_bytesize # rubocop:disable Style/IfUnlessModifier
    raise ValidationError.new("Encoded SAML Message exceeds #{max_bytesize} bytes, so was rejected")
  end

+  return message unless base64_encoded?(message)
+
  message = try_inflate(base64_decode(message))

  if message.bytesize > max_bytesize # rubocop:disable Style/IfUnlessModifier

Source: GitHub Commit 38ef5dd. The patch moves the bytesize check ahead of the base64_encoded? inspection, ensuring oversized inputs are rejected before any content parsing.

Detection Methods for CVE-2025-54572

Indicators of Compromise

Elevated CPU or memory consumption on Ruby application processes handling /saml/* or ACS (Assertion Consumer Service) endpoints
HTTP POST requests to SAML endpoints containing SAMLResponse parameters significantly larger than typical SAML assertions (multi-megabyte payloads)
Repeated requests from the same source IP addresses targeting SAML authentication endpoints

Detection Strategies

Monitor web application logs for POST requests to SAML ACS endpoints where request body size exceeds a reasonable threshold (for example, 256 KB)
Inspect application performance monitoring data for latency spikes correlated with SAML authentication flows
Alert on ValidationError exceptions raised from ruby-saml at abnormal frequency

Monitoring Recommendations

Instrument the SAML processing pipeline to record message sizes and rejection reasons
Correlate resource utilization metrics with SAML request volume from web application firewall (WAF) logs
Track the version of ruby-saml deployed across services using software composition analysis tooling

How to Mitigate CVE-2025-54572

Immediate Actions Required

Upgrade ruby-saml to version 1.18.1 or later in all applications using the library
Rebuild and redeploy application containers or bundler-managed dependencies after upgrading the gem
Apply Debian LTS package updates on affected distributions per the Debian LTS Announcement

Patch Information

The fix is available in ruby-saml v1.18.1. See the GitHub Release v1.18.1, the GitHub Pull Request #770, and the GitHub Security Advisory GHSA-rrqh-93c8-j966 for complete details.

Workarounds

Deploy a WAF or reverse-proxy rule that limits the maximum request body size for POST requests to SAML ACS endpoints
Rate-limit requests to SAML authentication endpoints on a per-source-IP basis
Terminate long-running SAML processing requests using web server timeouts until the patch is applied

bash

# Nginx configuration example: cap SAML POST body size
location /saml/acs {
    client_max_body_size 256k;
    client_body_timeout 10s;
    proxy_pass http://ruby_app;
}

# Bundler upgrade
bundle update ruby-saml --conservative
bundle list | grep ruby-saml   # verify 1.18.1 or later