CVE-2023-28119: Denial Of Service Via Deflate Decompression Bomb in github.com/crewjam/saml
Summary
CVE-2023-28119: Denial of service via deflate compression bomb in github.com/crewjam/saml. Affects github.com/crewjam/saml versions < 0.4.13. Fixed in 0.4.13. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
github.com/crewjam/saml is a Go package that provides functionality for processing SAML (Security Assertion Markup Language) requests and responses. It is commonly used in applications that require SAML-based authentication and authorization. This package allows developers to handle SAML assertions, generate SAML responses, and validate SAML signatures. However, a vulnerability has been discovered in the package that could lead to a Denial of Service (DoS) attack.
Vulnerability Detail
The vulnerability in github.com/crewjam/saml arises from the improper handling of input data during the decompression process using the Deflate algorithm. The package uses flate.NewReader, which does not limit the size of the input. An attacker can exploit this by sending a large amount of data in the HTTP request, causing the server-side decompression to consume excessive resources and potentially crash the process. By repeatedly sending the same request, an attacker can reliably trigger a DoS condition. The severity of this vulnerability is rated as HIGH with a CVSS score of 7.5.
How To Fix
Latest published version: v0.5.1 as of 23 Oct 2026
go get github.com/crewjam/saml@v0.5.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.4.13
This is the first release that contains the fix.
go get github.com/crewjam/saml@v0.4.13Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix mentioned in the 'how_to_fix' section.
Conclusion
The vulnerability in github.com/crewjam/saml can be exploited to cause a Denial of Service (DoS) condition. It is crucial for developers to update their usage of the package to version 0.4.13 or later to mitigate this vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/crewjam/saml →
FAQ
github.com/crewjam/saml is a Go package used for processing SAML requests and responses in applications that require SAML-based authentication and authorization.
This vulnerability can be exploited by an attacker to cause a Denial of Service (DoS) condition, potentially crashing the server process.
To fix this vulnerability, update your usage of github.com/crewjam/saml to version 0.4.13 or later.
There is no known workaround for this vulnerability. It is recommended to apply the fix mentioned in the 'how_to_fix' section.
The severity of this vulnerability is rated as HIGH with a CVSS score of 7.5.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/crewjam/saml.
