CVE-2023-28119

Published: Mar 22, 2023Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

The crewjam/saml go library contains a partial implementation of the SAML standard in golang. Prior to version 0.4.13, the package's use of `flate.NewReader` does not limit the size of the input. The user can pass more than 1 MB of data in the HTTP request to the processing functions, which will be decompressed server-side using the Deflate algorithm. Therefore, after repeating the same request multiple times, it is possible to achieve a reliable crash since the operating system kills the process. This issue is patched in version 0.4.13.

Affected (1)

Products: Saml Project: Saml

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Saml Project Saml	Version 0.4.12

Related CWEs

Allocation of Resources Without Limits or Throttling

The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

References (4)

https://github.com/crewjam/saml/commit/8e9236867d176ad6338c870a84e2039aef8a5021

Source: security-advisories@github.com

Patch

https://github.com/crewjam/saml/security/advisories/GHSA-5mqj-xc49-246p

Source: security-advisories@github.com

Vendor Advisory

https://github.com/crewjam/saml/commit/8e9236867d176ad6338c870a84e2039aef8a5021

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://github.com/crewjam/saml/security/advisories/GHSA-5mqj-xc49-246p

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.