CVE-2023-28119 - CVE House
Back to Database
Status published High CVE-2023-28119

crewjam/saml vulnerable to Denial Of Service Via Deflate Decompression Bomb

Vulnerability Description

The crewjam/saml go library contains a partial implementation of the SAML standard in golang. Prior to version 0.4.13, the package's use of `flate.NewReader` does not limit the size of the input. The user can pass more than 1 MB of data in the HTTP request to the processing functions, which will be decompressed server-side using the Deflate algorithm. Therefore, after repeating the same request multiple times, it is possible to achieve a reliable crash since the operating system kills the process. This issue is patched in version 0.4.13.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-28119

Credits & Attribution

No credits recorded in the NVD database.

References

More from crewjam

View All →
CVE-2023-45683
Cross site scripting via missing binding syntax validation In ACS location in github.com/crewjam/saml
High 7.1
CVE-2022-41912
crewjam/saml go library is vulnerable to signature bypass via multiple Assertion elements
Critical 9.1

Affected Vendor

Affected Software

saml
Vulnerable Versions:
< 0.4.13

Timeline

Official Publish: March 22nd, 2023
Last Modified: February 25th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

CWE-770

MITRE ATT&CK TTPs

T1499 Endpoint Denial of Service
Impact
T1498 Network Denial of Service
Impact
T1190 Exploit Public-Facing Application
Initial Access
T1562 Impair Defenses
Defense Evasion
T1046 Network Service Discovery
Discovery