GHSA-5cjr-mxj5-wmrx

Source

https://github.com/advisories/GHSA-5cjr-mxj5-wmrx

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-5cjr-mxj5-wmrx/GHSA-5cjr-mxj5-wmrx.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-5cjr-mxj5-wmrx

Aliases

CVE-2026-49289

Published

2026-07-02T20:27:23Z

Modified

2026-07-02T20:45:16.214576786Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

SimpleSAMLphp has Possible DoS via XPath Transform

Details

Summary

This library turned out to be vulnerable to Denial-of-Service attacks using XPath transforms. A mitigation has been put in place to restrict the number of transforms and to restrict transforms to only the transform-algorithms mentioned in the SAML 2.0 Core Specifications (and specifically refuse XPath transforms).

Impact

An attacker is able to send specially crafted messages to any entity relying on SimpleSAMLphp (or directly on this SAML2-library) to be able to perform a Denial-of-Service attack.

Database specific

{
    "github_reviewed_at": "2026-07-02T20:27:23Z",
    "nvd_published_at": null,
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-400"
    ],
    "severity": "HIGH"
}

References

Affected packages

Packagist / simplesamlphp/saml2

Package

Name: simplesamlphp/saml2
Purl: pkg:composer/simplesamlphp%2Fsaml2

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

4.20.3

Affected versions

v0.*

v0.1.0-alpha

v0.1.0

v0.3.0

v0.4.0

v0.4.1

v0.4.2

v0.5.0

v0.6.0

v0.6.1

v0.6.2

v0.6.3

v0.6.4

v0.7.0

v0.7.1

v0.8.0

v0.8.1

v1.*

v1.0.0

v1.1.0

v1.2.0

v1.3.0

v1.3.1

v1.3.2

v1.4.0

v1.5.0

v1.5.1

v1.5.2

v1.5.3

v1.5.4

v1.6.0

v1.6.1

v1.7.0

v1.7.1

v1.7.2

v1.8

v1.8.1

v1.8.2

v1.9

v1.9.1

v1.9.2

v1.10

v1.10.1

v1.10.2

v1.10.3

v1.10.4

v1.10.5

v1.10.6

v2.*

v2.0.0

v2.0.1

v2.1

v2.2

v2.3

v2.3.1

v2.3.2

v2.3.3

v2.3.4

v2.3.5

v2.3.6

v2.3.7

v2.3.8

v2.3.9

v3.*

v3.0.0

v3.0.1

v3.0.2

v3.0.3

v3.1.0

v3.1.1

v3.1.2

v3.1.3

v3.1.4

v3.1.5

v3.1.6

v3.2

v3.2.1

v3.2.2

v3.2.3

v3.2.4

v3.2.5

v3.2.6

v3.3.0

v3.3.1

v3.3.2

v3.3.3

v3.3.4

v3.3.5

v3.3.6

v3.3.7

v3.3.8

v3.3.9

v3.3.10

v3.3.11

v3.4.0

v3.4.1

v3.4.2

v3.4.3

v3.4.4

v3.4.5

v4.*

v4.0.0

v4.0.1

v4.0.2

v4.0.3

v4.1.0

v4.1.1

v4.1.2

v4.1.3

v4.1.4

v4.1.5

v4.1.6

v4.1.7

v4.1.8

v4.1.9

v4.1.10

v4.1.11

v4.1.12

v4.2.0

v4.2.1

v4.2.2

v4.2.3

v4.2.4

v4.2.5

v4.2.6

v4.2.7

v4.2.8

v4.3.0

v4.3.1

v4.4.0

v4.4.1

v4.5.0

v4.5.1

v4.6.0

v4.6.1

v4.6.2

v4.6.3

v4.6.4

v4.6.5

v4.6.6

v4.6.7

v4.6.8

v4.6.10

v4.6.11

v4.6.12

v4.6.13

v4.6.14

v4.6.15

v4.6.16

v4.16.14

v4.17.0

v4.18.0

v4.18.1

v4.19.0

v4.19.1

v4.19.2

v4.20.0

v4.20.1

v4.20.2

4.*

4.6.9

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-5cjr-mxj5-wmrx/GHSA-5cjr-mxj5-wmrx.json"

last_known_affected_version_range

"<= 4.20.2"

Packagist / simplesamlphp/saml2-legacy