crewjam/saml vulnerable to Denial Of Service Via Deflate Decompression Bomb

HIGH 7.5CVE-2023-28119 · GHSA-5mqj-xc49-246p · GO-2023-1664 · Published 22/03/2023 · updated 17/06/2026

Package	Affected versions	Patched versions
github.com/crewjam/saml Go	`< 0.4.13`	`0.4.13`
saml saml_project	`= 0.4.12`	No fix yet

Description

Our use of flate.NewReader does not limit the size of the input. The user could pass more than 1 MB of data in the HTTP request to the processing functions, which will be decompressed server-side using the Deflate algorithm. Therefore, after repeating the same request multiple times, it is possible to achieve a reliable crash since the operating system kills the process.

NVD description

The crewjam/saml go library contains a partial implementation of the SAML standard in golang. Prior to version 0.4.13, the package's use of `flate.NewReader` does not limit the size of the input. The user can pass more than 1 MB of data in the HTTP request to the processing functions, which will be decompressed server-side using the Deflate algorithm. Therefore, after repeating the same request multiple times, it is possible to achieve a reliable crash since the operating system kills the process. This issue is patched in version 0.4.13.

References

crewjam/saml security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2023-28119 · ADVISORY
crewjam/saml commit 8e92368 · WEB
crewjam/saml · PACKAGE

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free