- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 10 · 6 critical, 2 high, 1 medium
- Registry
- RubyGems
Advisories 10
- CVE-2025-66568Critical 9.3
ruby-saml Libxml2 Canonicalization errors can bypass Digest/Signature validation
Affected: fixed in 1.18.0.
- CVE-2025-66567Critical 9.3
ruby-saml has a SAML authentication bypass due to namespace handling (parser differential)
Affected: fixed in 1.18.0.
- CVE-2025-54572Medium 6.9
Ruby SAML DOS vulnerability with large SAML response
Affected: fixed in 1.18.1.
- CVE-2025-25292Critical 9.3
Ruby SAML vulnerable to SAML authentication bypass due to namespace handling (parser differential)
Affected: from 1.13.0, fixed in 1.18.0; fixed in 1.12.4.
- CVE-2025-25291Critical 9.3
ruby-saml vulnerable to SAML authentication bypass due to DOCTYPE handling (parser differential)
Affected: fixed in 1.12.4; from 1.13.0, fixed in 1.18.0.
- CVE-2025-25293High 7.7
ruby-saml vulnerable to Remote Denial of Service (DoS) with compressed SAML responses
Affected: fixed in 1.12.4; from 1.13.0, fixed in 1.18.0.
- CVE-2024-45409Critical 10.0
The Ruby SAML library vulnerable to a SAML authentication bypass via Incorrect XPath selector
Affected: fixed in 1.12.3; from 1.13.0, fixed in 1.17.0.
- CVE-2015-20108Critical 9.8
xml_security.rb in the ruby-saml gem before 1.0.0 for Ruby allows XPath injection and code execution because prepared statements are not…
Affected: fixed in 1.0.0.
- CVE-2017-11428High 7.7
Multiple SAML libraries may allow authentication bypass via incorrect XML canonicalization and DOM traversal
Affected: fixed in 1.7.0.
- CVE-2016-5697Unrated
Ruby-saml before 1.3.0 allows attackers to perform XML signature wrapping attacks via unspecified vectors.
Affected: fixed in 1.3.0.