The SimpleSAMLphp SAML2 library allows an attacker to supply XPath transforms while it processes XML signatures in SAML messages. The library does not restrict or validate the transforms, which lets the attacker execute XPath expressions that consume excessive CPU or memory. This resource exhaustion results in a denial of service that can affect any system that relies on SimpleSAMLphp or the SAML2 library, without requiring authentication.

The vulnerability affects the SimpleSAMLphp SAML2 PHP library. The affected versions are 4.19.2 and 4.20.2. Fixes were released in 4.19.3 and 4.20.3, and later releases are presumed to be safe.

The CVSS score of 7.5 indicates a high impact denial of service scenario. The EPSS score is not provided, so the exact probability of active exploitation is unclear, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a remote unauthenticated attacker sending a specially crafted SAML message that contains a malicious XPath transform, which the library will process during signature verification. If the target application uses the vulnerable library to validate SAML responses, the crafted message can cause the target to exhaust processing resources, leading to a service interruption.