CVE-2023-28119

The crewjam/saml go library contains a partial implementation of the SAML standard in golang. Prior to version 0.4.13, the package's use of `flate.NewReader` does not limit the size of the input. The user can pass more than 1 MB of data in the HTTP request to the processing functions, which will be decompressed server-side using the Deflate algorithm. Therefore, after repeating the same request multiple times, it is possible to achieve a reliable crash since the operating system kills the process. This issue is patched in version 0.4.13.

• CWE-770

• https://github.com/crewjam/saml/commit/8e9236867d176ad6338c870a84e2039aef8a5021Patch
• https://github.com/crewjam/saml/security/advisories/GHSA-5mqj-xc49-246pVendor Advisory
• https://github.com/crewjam/saml/commit/8e9236867d176ad6338c870a84e2039aef8a5021Patch
• https://github.com/crewjam/saml/security/advisories/GHSA-5mqj-xc49-246pVendor Advisory

Published

Mar 22, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-28113russh is a Rust SSH client and server library. Starting in v…5.9
• CVE-2023-28114`cilium-cli` is the command line interface to install, manag…4.1
• CVE-2023-28115Snappy is a PHP library allowing thumbnail, snapshot or PDF …9.8
• CVE-2023-28116Contiki-NG is an open-source, cross-platform operating syste…9.8
• CVE-2023-28117Sentry SDK is the official Python SDK for Sentry, real-time …6.5
• CVE-2023-28118kaml provides YAML support for kotlinx.serialization. Prior …7.5
• CVE-2023-2812The Ultimate Dashboard WordPress plugin before 3.7.6 does no…4.8
• CVE-2023-28120There is a vulnerability in ActiveSupport if the new bytespl…5.3
• CVE-2023-28121An issue in WooCommerce Payments plugin for WordPress (versi…9.8
• CVE-2023-28122A local privilege escalation (LPE) vulnerability in UI Deskt…7.8
• CVE-2023-28123A permission misconfiguration in UI Desktop for Windows (Ver…5.5
• CVE-2023-28124Improper usage of symmetric encryption in UI Desktop for Win…5.5