{"id":"CVE-2023-26483","aliases":["GHSA-6gc3-crp7-25w5","GO-2023-1602"],"title":"gosaml2 vulnerable to Denial Of Service Via Deflate Decompression Bomb","summary":"gosaml2 vulnerable to Denial Of Service Via Deflate Decompression Bomb","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","vendor":"russellhaering","product":"github.com/russellhaering/gosaml2","ecosystem":"go","affected":["github.com/russellhaering/gosaml2 < 0.9.0"],"patched":["github.com/russellhaering/gosaml2 0.9.0"],"published":"2023-03-02","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:49:52.708847794Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-6gc3-crp7-25w5","references":[{"url":"https://github.com/russellhaering/gosaml2/security/advisories/GHSA-6gc3-crp7-25w5"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-26483"},{"url":"https://github.com/russellhaering/gosaml2/commit/f9d66040241093e8702649baff50cc70d2c683c0"},{"url":"https://github.com/russellhaering/gosaml2"},{"url":"https://github.com/russellhaering/gosaml2/releases/tag/v0.9.0"},{"url":"https://pkg.go.dev/vuln/GO-2023-1602"}],"tags":["osv","go"],"epss":0.00964,"epssPercentile":0.6022,"ingestedAt":"2026-09-12T03:13:01.759Z","slug":"CVE-2023-26483","body":"## Overview\n\n### Impact\nSAML Service Providers using this library for SAML authentication support are likely susceptible to Denial of Service attacks. A bug in this library enables attackers to craft a `deflate`-compressed request which will consume significantly more memory during processing than the size of the original request. This may eventually lead to memory exhaustion and the process being killed.\n\n### Mitigation\nThe maximum compression ratio achievable with `deflate` is 1032:1, so by limiting the size of bodies passed to gosaml2, limiting the rate and concurrency of calls, and ensuring that lots of memory is available to the process it _may_ be possible to help Go's garbage collector \"keep up\".\n\nImplementors are encouraged not to rely on this.\n\n### Patches\nThis issue is addressed in v0.9.0\n\n## Affected packages\n\n- `github.com/russellhaering/gosaml2 < 0.9.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/russellhaering/gosaml2 0.9.0`","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}