{"id":"GHSA-6gc3-crp7-25w5","summary":"gosaml2 vulnerable to Denial Of Service Via Deflate Decompression Bomb","details":"### Impact\nSAML Service Providers using this library for SAML authentication support are likely susceptible to Denial of Service attacks. A bug in this library enables attackers to craft a `deflate`-compressed request which will consume significantly more memory during processing than the size of the original request. This may eventually lead to memory exhaustion and the process being killed.\n\n### Mitigation\nThe maximum compression ratio achievable with `deflate` is 1032:1, so by limiting the size of bodies passed to gosaml2, limiting the rate and concurrency of calls, and ensuring that lots of memory is available to the process it _may_ be possible to help Go's garbage collector \"keep up\".\n\nImplementors are encouraged not to rely on this.\n\n### Patches\nThis issue is addressed in v0.9.0","aliases":["CVE-2023-26483","GO-2023-1602"],"modified":"2026-09-10T03:49:52.708847794Z","published":"2023-03-02T23:12:47Z","database_specific":{"nvd_published_at":"2023-03-03T23:15:00Z","cwe_ids":["CWE-409"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2023-03-02T23:12:47Z"},"references":[{"type":"WEB","url":"https://github.com/russellhaering/gosaml2/security/advisories/GHSA-6gc3-crp7-25w5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-26483"},{"type":"WEB","url":"https://github.com/russellhaering/gosaml2/commit/f9d66040241093e8702649baff50cc70d2c683c0"},{"type":"PACKAGE","url":"https://github.com/russellhaering/gosaml2"},{"type":"WEB","url":"https://github.com/russellhaering/gosaml2/releases/tag/v0.9.0"},{"type":"WEB","url":"https://pkg.go.dev/vuln/GO-2023-1602"}],"affected":[{"package":{"name":"github.com/russellhaering/gosaml2","ecosystem":"Go","purl":"pkg:golang/github.com/russellhaering/gosaml2"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.9.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/03/GHSA-6gc3-crp7-25w5/GHSA-6gc3-crp7-25w5.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}]}