# ruby-saml (RubyGems) vulnerabilities

10 known vulnerabilities (6 critical, 2 high, 1 medium), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://rubygems.org/gems/ruby-saml

## Advisories (10)

### [CVE-2025-66568](https://cve.now/CVE-2025-66568): ruby-saml Libxml2 Canonicalization errors can bypass Digest/Signature validation

- Severity: Critical 9.3
- Published: Dec 9, 2025
- Affected: fixed in 1.18.0.

### [CVE-2025-66567](https://cve.now/CVE-2025-66567): ruby-saml has a SAML authentication bypass due to namespace handling (parser differential)

- Severity: Critical 9.3
- Published: Dec 9, 2025
- Affected: fixed in 1.18.0.

### [CVE-2025-54572](https://cve.now/CVE-2025-54572): Ruby SAML DOS vulnerability with large SAML response

- Severity: Medium 6.9
- Published: Jul 30, 2025
- Affected: fixed in 1.18.1.

### [CVE-2025-25292](https://cve.now/CVE-2025-25292): Ruby SAML vulnerable to SAML authentication bypass due to namespace handling (parser differential)

- Severity: Critical 9.3
- Published: Mar 12, 2025
- Affected: from 1.13.0, fixed in 1.18.0; fixed in 1.12.4.

### [CVE-2025-25291](https://cve.now/CVE-2025-25291): ruby-saml vulnerable to SAML authentication bypass due to DOCTYPE handling (parser differential)

- Severity: Critical 9.3
- Published: Mar 12, 2025
- Affected: fixed in 1.12.4; from 1.13.0, fixed in 1.18.0.

### [CVE-2025-25293](https://cve.now/CVE-2025-25293): ruby-saml vulnerable to Remote Denial of Service (DoS) with compressed SAML responses

- Severity: High 7.7
- Published: Mar 12, 2025
- Affected: fixed in 1.12.4; from 1.13.0, fixed in 1.18.0.

### [CVE-2024-45409](https://cve.now/CVE-2024-45409): The Ruby SAML library vulnerable to a SAML authentication bypass via Incorrect XPath selector

- Severity: Critical 10.0
- Published: Sep 10, 2024
- Affected: fixed in 1.12.3; from 1.13.0, fixed in 1.17.0.

### [CVE-2015-20108](https://cve.now/CVE-2015-20108): xml\_security.rb in the ruby-saml gem before 1.0.0 for Ruby allows XPath injection and code execution because prepared statements are not…

- Severity: Critical 9.8
- Published: May 27, 2023
- Affected: fixed in 1.0.0.

### [CVE-2017-11428](https://cve.now/CVE-2017-11428): Multiple SAML libraries may allow authentication bypass via incorrect XML canonicalization and DOM traversal

- Severity: High 7.7
- Published: Apr 17, 2019
- Affected: fixed in 1.7.0.

### [CVE-2016-5697](https://cve.now/CVE-2016-5697): Ruby-saml before 1.3.0 allows attackers to perform XML signature wrapping attacks via unspecified vectors.

- Severity: Unrated
- Published: Jan 23, 2017
- Affected: fixed in 1.3.0.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/rubygems/ruby-saml
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.