{
  "cveId": "CVE-2025-25293",
  "url": "https://patchblox.com/security/cve/CVE-2025-25293",
  "summary": "CVE-2025-25293 is fixed in ruby-saml on 1 platform, first by ruby-saml 1.7.2-1ubuntu0.1~esm2, released March 12, 2025. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "ruby-saml: ruby-saml provides security assertion markup language (SAML) single sign-on(SSO) for Ruby",
  "description": "ruby-saml provides security assertion markup language (SAML) single sign-on(SSO) for Ruby. Prior to versions 1.12.4 and 1.18.0, ruby-saml issusceptible to remote Denial of Service (DoS) with compressed SAMLresponses. ruby-saml uses zlib to decompress SAML responses in case they\u0027recompressed. It is possible to bypass the message size check with acompressed assertion since the message size is checked before inflation andnot after. This issue may lead to remote Denial of Service (DoS). Versions1.12.4 and 1.18.0 fix the issue.",
  "published": "2025-03-12T14:15:00Z",
  "severity": "Medium",
  "epss": 0.01528,
  "epssPercentile": 0.74875,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "ruby-saml",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "1.7.2-1ubuntu0.1~esm2",
      "fix": "ruby-saml 1.7.2-1ubuntu0.1~esm2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-ruby-saml-1.7.2-1ubuntu0.1-esm2",
      "released": "2025-03-12T14:15:00Z"
    },
    {
      "platform": "linux",
      "product": "ruby-saml",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "1.11.0-1ubuntu0.1\u002Besm1",
      "fix": "ruby-saml 1.11.0-1ubuntu0.1\u002Besm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-ruby-saml-1.11.0-1ubuntu0.1-esm1",
      "released": "2025-03-12T14:15:00Z"
    },
    {
      "platform": "linux",
      "product": "ruby-saml",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "1.13.0-1ubuntu0.1\u002Besm1",
      "fix": "ruby-saml 1.13.0-1ubuntu0.1\u002Besm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-ruby-saml-1.13.0-1ubuntu0.1-esm1",
      "released": "2025-03-12T14:15:00Z"
    },
    {
      "platform": "linux",
      "product": "ruby-saml",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "1.15.0-1ubuntu0.24.04.1\u002Besm1",
      "fix": "ruby-saml 1.15.0-1ubuntu0.24.04.1\u002Besm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-ruby-saml-1.15.0-1ubuntu0.24.04.1-esm1",
      "released": "2025-03-12T14:15:00Z"
    },
    {
      "platform": "linux",
      "product": "ruby-saml",
      "release": "Ubuntu 24.10 (oracular)",
      "fixedVersion": "1.15.0-1ubuntu0.24.10.2",
      "fix": "ruby-saml 1.15.0-1ubuntu0.24.10.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-oracular-ruby-saml-1.15.0-1ubuntu0.24.10.2",
      "released": "2026-01-16T01:42:24Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}