CVE-2026-49289
CVE-2026-49289 · SimpleSAMLphp SAML2: Possible DoS via XPath Transform
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. In 4.19.2 and 4.20.2, the library permits attacker-controlled XPath transforms while processing XML signatures in specially crafted SAML messages. XPath evaluation can consume uncontrolled processing resources, allowing a remote unauthenticated attacker to deny service to any entity relying on SimpleSAMLphp or directly on the SAML2 library. The mitigation limits the number of transforms, permits only transform algorithms identified by the SAML 2.0 Core specification, and specifically rejects XPath transforms. This issue is fixed in versions 4.19.3 and 4.20.3.
CVSS 7.5 · High · EPSS 0.8% · Fix available
- Published
- Updated
Affected products and versions
saml2
- Versions
- >= 4.19.2, < 4.19.3: Affected
- >= 4.20.2, < 4.20.3: Affected
No fix published
simplesamlphp Debian:12
- Versions
- 1.19.7-1
- 1.19.7-1+deb12u1
- 1.19.7-1+deb12u2
- 1.19.7-2
- 2.1.8-0.1
- 2.2.6-1
- 2.3.11-1
- 2.3.11-2
- 2.4.8-1
- 2.5.3.1-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
simplesamlphp Debian:14
- Versions
- 1.10.0-1
- 1.11.0-1
- 1.12.0-1
- 1.12.0~rc1-1
- 1.12.0~rc2-1
- 1.13.0-1
- 1.13.1-1
- 1.13.1-2
- 1.13.2-1
- 1.14.0-1
- 1.14.1-1
- 1.14.10-1
- 1.14.11-1
- 1.14.15-1
- 1.14.2-1
- 1.14.2-2
- 1.14.3-1
- 1.14.4-1
- 1.14.5-1
- 1.14.6-1
- 1.14.7-1
- 1.14.8-1
- 1.14.9-1
- 1.15.0-1
- 1.15.1-1
- 1.15.2-1
- 1.15.3-1
- 1.15.4-1
- 1.16.0-1
- 1.16.1-1
- 1.16.2-1
- 1.16.3-1
- 1.17.0-1
- 1.17.1-1
- 1.17.2-1
- 1.17.2-2
- 1.17.3-1
- 1.17.4-1
- 1.17.5-1
- 1.17.6-1
- 1.17.6-2
- 1.18.1-1
- 1.18.4-1
- 1.18.5-1
- 1.18.6-1
- 1.18.7-1
- 1.18.8-1
- 1.19.0-1
- 1.19.1-1
- 1.19.1-1.1
- 1.19.6-1
- 1.19.7-1
- 1.19.7-2
- 1.6.0-1
- 1.6.1-1
- 1.6.2-1
- 1.6.3-1
- 1.6.3-2
- 1.6.3-3
- 1.7.0-1
- 1.7.0-2
- 1.8.0-1
- 1.8.1-1
- 1.8.2-1
- 1.9.0-1
- 1.9.0~rc1-1
- 1.9.0~rc2-1
- 1.9.1-1
- 1.9.2-1
- 2.1.8-0.1
- 2.2.6-1
- 2.3.11-1
- 2.3.11-2
- 2.4.8-1
- 2.5.3.1-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
simplesamlphp/saml2 Packagist
- Versions
- v4.20.0
- v4.20.1
- v4.20.2
- Affected ranges
- ECOSYSTEM: ≥ 4.20.0, < 4.20.3
Update to 4.20.3
simplesamlphp/saml2-legacy Packagist
- Versions
- v4.20.0
- v4.20.1
- v4.20.2
- Affected ranges
- ECOSYSTEM: ≥ 4.20.0, < 4.20.3
Update to 4.20.3
simplesamlphp/saml2 Packagist
- Versions
- 4.6.9
- v0.1.0
- v0.1.0-alpha
- v0.3.0
- v0.4.0
- v0.4.1
- v0.4.2
- v0.5.0
- v0.6.0
- v0.6.1
- v0.6.2
- v0.6.3
- v0.6.4
- v0.7.0
- v0.7.1
- v0.8.0
- v0.8.1
- v1.0.0
- v1.1.0
- v1.10
- v1.10.1
- v1.10.2
- v1.10.3
- v1.10.4
- v1.10.5
- v1.10.6
- v1.2.0
- v1.3.0
- v1.3.1
- v1.3.2
- v1.4.0
- v1.5.0
- v1.5.1
- v1.5.2
- v1.5.3
- v1.5.4
- v1.6.0
- v1.6.1
- v1.7.0
- v1.7.1
- v1.7.2
- v1.8
- v1.8.1
- v1.8.2
- v1.9
- v1.9.1
- v1.9.2
- v2.0.0
- v2.0.1
- v2.1
- v2.2
- v2.3
- v2.3.1
- v2.3.2
- v2.3.3
- v2.3.4
- v2.3.5
- v2.3.6
- v2.3.7
- v2.3.8
- v2.3.9
- v3.0.0
- v3.0.1
- v3.0.2
- v3.0.3
- v3.1.0
- v3.1.1
- v3.1.2
- v3.1.3
- v3.1.4
- v3.1.5
- v3.1.6
- v3.2
- v3.2.1
- v3.2.2
- v3.2.3
- v3.2.4
- v3.2.5
- v3.2.6
- v3.3.0
- v3.3.1
- v3.3.10
- v3.3.11
- v3.3.2
- v3.3.3
- v3.3.4
- v3.3.5
- v3.3.6
- v3.3.7
- v3.3.8
- v3.3.9
- v3.4.0
- v3.4.1
- v3.4.2
- v3.4.3
- v3.4.4
- v3.4.5
- v4.0.0
- v4.0.1
- v4.0.2
- v4.0.3
- v4.1.0
- v4.1.1
- v4.1.10
- v4.1.11
- v4.1.12
- v4.1.2
- v4.1.3
- v4.1.4
- v4.1.5
- v4.1.6
- v4.1.7
- v4.1.8
- v4.1.9
- v4.16.14
- v4.17.0
- v4.18.0
- v4.18.1
- v4.19.0
- v4.19.1
- v4.19.2
- v4.2.0
- v4.2.1
- v4.2.2
- v4.2.3
- v4.2.4
- v4.2.5
- v4.2.6
- v4.2.7
- v4.2.8
- v4.3.0
- v4.3.1
- v4.4.0
- v4.4.1
- v4.5.0
- v4.5.1
- v4.6.0
- v4.6.1
- v4.6.10
- v4.6.11
- v4.6.12
- v4.6.13
- v4.6.14
- v4.6.15
- v4.6.16
- v4.6.2
- v4.6.3
- v4.6.4
- v4.6.5
- v4.6.6
- v4.6.7
- v4.6.8
- Affected ranges
- ECOSYSTEM: < 4.19.3
Update to 4.19.3
simplesamlphp/saml2-legacy Packagist
- Versions
- 4.6.9
- v0.1.0
- v0.1.0-alpha
- v0.3.0
- v0.4.0
- v0.4.1
- v0.4.2
- v0.5.0
- v0.6.0
- v0.6.1
- v0.6.2
- v0.6.3
- v0.6.4
- v0.7.0
- v0.7.1
- v0.8.0
- v0.8.1
- v1.0.0
- v1.1.0
- v1.10
- v1.10.1
- v1.10.2
- v1.10.3
- v1.10.4
- v1.10.5
- v1.10.6
- v1.2.0
- v1.3.0
- v1.3.1
- v1.3.2
- v1.4.0
- v1.5.0
- v1.5.1
- v1.5.2
- v1.5.3
- v1.5.4
- v1.6.0
- v1.6.1
- v1.7.0
- v1.7.1
- v1.7.2
- v1.8
- v1.8.1
- v1.8.2
- v1.9
- v1.9.1
- v1.9.2
- v2.0.0
- v2.0.1
- v2.1
- v2.2
- v2.3
- v2.3.1
- v2.3.2
- v2.3.3
- v2.3.4
- v2.3.5
- v2.3.6
- v2.3.7
- v2.3.8
- v2.3.9
- v3.0.0
- v3.0.1
- v3.0.2
- v3.0.3
- v3.1.0
- v3.1.1
- v3.1.2
- v3.1.3
- v3.1.4
- v3.1.5
- v3.1.6
- v3.2
- v3.2.1
- v3.2.2
- v3.2.3
- v3.2.4
- v3.2.5
- v3.2.6
- v3.3.0
- v3.3.1
- v3.3.10
- v3.3.11
- v3.3.2
- v3.3.3
- v3.3.4
- v3.3.5
- v3.3.6
- v3.3.7
- v3.3.8
- v3.3.9
- v3.4.0
- v3.4.1
- v3.4.2
- v3.4.3
- v4.0.0
- v4.0.1
- v4.0.2
- v4.0.3
- v4.1.0
- v4.1.1
- v4.1.10
- v4.1.11
- v4.1.12
- v4.1.2
- v4.1.3
- v4.1.4
- v4.1.5
- v4.1.6
- v4.1.7
- v4.1.8
- v4.1.9
- v4.16.14
- v4.17.0
- v4.18.0
- v4.18.1
- v4.19.0
- v4.19.1
- v4.19.2
- v4.2.0
- v4.2.1
- v4.2.2
- v4.2.3
- v4.2.4
- v4.2.5
- v4.2.6
- v4.2.7
- v4.2.8
- v4.3.0
- v4.3.1
- v4.4.0
- v4.4.1
- v4.5.0
- v4.5.1
- v4.6.0
- v4.6.1
- v4.6.10
- v4.6.11
- v4.6.12
- v4.6.13
- v4.6.14
- v4.6.15
- v4.6.16
- v4.6.2
- v4.6.3
- v4.6.4
- v4.6.5
- v4.6.6
- v4.6.7
- v4.6.8
- Affected ranges
- ECOSYSTEM: < 4.19.3
Update to 4.19.3
simplesamlphp Ubuntu:Pro:16.04:LTS
- Versions
- 1.13.2-1
- 1.14.0-1
- 1.14.0-1ubuntu2
- 1.14.0-1ubuntu2+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
simplesamlphp Ubuntu:Pro:18.04:LTS
- Versions
- 1.14.15-1
- 1.15.0-1
- 1.15.1-1
- 1.15.2-1
- 1.15.3-1
- 1.15.3-1ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
simplesamlphp Ubuntu:Pro:20.04:LTS
- Versions
- 1.17.5-1
- 1.17.6-1
- 1.17.6-2
- 1.18.1-1
- 1.18.4-1
- 1.18.4-1ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
simplesamlphp Ubuntu:Pro:22.04:LTS
- Versions
- 1.19.1-1
- 1.19.1-1.1
- 1.19.1-1.1ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
simplesamlphp Ubuntu:24.04:LTS
- Versions
- 1.19.7-1
- 1.19.7-1+deb12u1ubuntu0.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
simplesamlphp Ubuntu:26.10
- Versions
- 1.19.7-2
- 2.1.8-0.1
- 2.2.6-1
- 2.3.11-1
- 2.3.11-2
- 2.4.8-1
- 2.5.3.1-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
simplesamlphp Ubuntu:26.04:LTS
- Versions
- 1.19.7-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published