CVE-2020-27846: XML Processing error in github.com/crewjam/saml
Summary
CVE-2020-27846: XML Processing error in github.com/crewjam/saml. Affects github.com/crewjam/saml versions < 0.4.3. Fixed in 0.4.3. How to fix ↓
Also tracked for
- grafana · Bitnami
The same CVE-2020-27846 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package github.com/crewjam/saml is a Go library that provides functionality for working with Security Assertion Markup Language (SAML) in XML format. SAML is an XML-based standard for exchanging authentication and authorization data between parties. The library allows developers to generate and parse SAML documents, as well as perform various operations on them.
Vulnerability Detail
This vulnerability involves three vulnerabilities in the go encoding/xml package used by github.com/crewjam/saml. These vulnerabilities can be exploited by an attacker to manipulate parts of a signed XML document. The specific technical details of the vulnerabilities can be found in the xml-roundtrip-validator repository (https://github.com/mattermost/xml-roundtrip-validator). The impact of these vulnerabilities is significant, as they can allow an attacker to forge parts of a signed XML document, potentially leading to authentication bypass, data tampering, or other security breaches.
How To Fix
Latest published version: v0.5.1 as of 23 Oct 2026
go get github.com/crewjam/saml@v0.5.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.4.3
This is the first release that contains the fix.
go get github.com/crewjam/saml@v0.4.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the github.com/crewjam/saml package is vulnerable to XML processing errors that can be exploited to forge parts of a signed XML document. It is crucial to update to version 0.4.3 or later to mitigate these vulnerabilities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/crewjam/saml →
FAQ
The vulnerabilities can allow an attacker to forge parts of a signed XML document, potentially leading to authentication bypass, data tampering, or other security breaches.
To fix this vulnerability, update the github.com/crewjam/saml package to version 0.4.3 or later.
No, there are no known workarounds for these vulnerabilities. Updating to the fixed version is the recommended solution.
Yes, the xml-roundtrip-validator repository (https://github.com/mattermost/xml-roundtrip-validator) provides details and example code to demonstrate the vulnerabilities.
You can refer to the SAML specification (https://www.oasis-open.org/standards#samlv2.0) and XML security best practices guides for more information.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/crewjam/saml.
