---
id: CVE-2023-28119
aliases:
  - GHSA-5mqj-xc49-246p
  - GO-2023-1664
title: crewjam/saml vulnerable to Denial Of Service Via Deflate Decompression Bomb
summary: crewjam/saml vulnerable to Denial Of Service Via Deflate Decompression Bomb
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
vendor: crewjam
product: github.com/crewjam/saml
ecosystem: go
affected:
  - github.com/crewjam/saml < 0.4.13
patched:
  - github.com/crewjam/saml 0.4.13
published: '2023-03-22'
updated: '2026-08-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-5mqj-xc49-246p'
references:
  - url: 'https://github.com/crewjam/saml/security/advisories/GHSA-5mqj-xc49-246p'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2023-28119'
  - url: >-
      https://github.com/crewjam/saml/commit/8e9236867d176ad6338c870a84e2039aef8a5021
  - url: 'https://github.com/crewjam/saml'
tags:
  - osv
  - go
epss: 0.00957
epssPercentile: 0.59785
ingestedAt: '2026-08-07T19:14:15.819Z'
---

## Overview

Our use of flate.NewReader does not limit the size of the input. The user could pass more than 1 MB of data in the HTTP request to the processing functions, which will be decompressed server-side using the Deflate algorithm. Therefore, after repeating the same request multiple times, it is possible to achieve a reliable crash since the operating system kills the process.


## Affected packages

- `github.com/crewjam/saml < 0.4.13`

## Remediation

Upgrade to a patched release:

- `github.com/crewjam/saml 0.4.13`