DEBIAN-CVE-2026-49289

See a problem?
Please try reporting it to the source first.

Source

https://security-tracker.debian.org/tracker/CVE-2026-49289

Import Source

https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-49289.json

JSON Data

https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-49289

Upstream

CVE-2026-49289

Published

2026-08-19T15:17:07Z

Modified

2026-09-19T22:47:38Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

[none]

Details

The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. In 4.19.2 and 4.20.2, the library permits attacker-controlled XPath transforms while processing XML signatures in specially crafted SAML messages. XPath evaluation can consume uncontrolled processing resources, allowing a remote unauthenticated attacker to deny service to any entity relying on SimpleSAMLphp or directly on the SAML2 library. The mitigation limits the number of transforms, permits only transform algorithms identified by the SAML 2.0 Core specification, and specifically rejects XPath transforms. This issue is fixed in versions 4.19.3 and 4.20.3.

References

https://security-tracker.debian.org/tracker/CVE-2026-49289

Affected packages

Debian:12 / simplesamlphp

Package

Name: simplesamlphp
Purl: pkg:deb/debian/simplesamlphp?arch=source&distro=bookworm

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.19.7-1

1.19.7-1+deb12u1

1.19.7-1+deb12u2

1.19.7-2

2.*

2.1.8-0.1

2.2.6-1

2.3.11-1

2.3.11-2

2.4.8-1

2.5.3.1-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-49289.json"

Debian:14 / simplesamlphp

Package

Name: simplesamlphp
Purl: pkg:deb/debian/simplesamlphp?arch=source&distro=forky

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.6.0-1

1.6.1-1

1.6.2-1

1.6.3-1

1.6.3-2

1.6.3-3

1.7.0-1

1.7.0-2

1.8.0-1

1.8.1-1

1.8.2-1

1.9.0~rc1-1

1.9.0~rc2-1

1.9.0-1

1.9.1-1

1.9.2-1

1.10.0-1

1.11.0-1

1.12.0~rc1-1

1.12.0~rc2-1

1.12.0-1

1.13.0-1

1.13.1-1

1.13.1-2

1.13.2-1

1.14.0-1

1.14.1-1

1.14.2-1

1.14.2-2

1.14.3-1

1.14.4-1

1.14.5-1

1.14.6-1

1.14.7-1

1.14.8-1

1.14.9-1

1.14.10-1

1.14.11-1

1.14.15-1

1.15.0-1

1.15.1-1

1.15.2-1

1.15.3-1

1.15.4-1

1.16.0-1

1.16.1-1

1.16.2-1

1.16.3-1

1.17.0-1

1.17.1-1

1.17.2-1

1.17.2-2

1.17.3-1

1.17.4-1

1.17.5-1

1.17.6-1

1.17.6-2

1.18.1-1

1.18.4-1

1.18.5-1

1.18.6-1

1.18.7-1

1.18.8-1

1.19.0-1

1.19.1-1

1.19.1-1.1

1.19.6-1