The SimpleSAMLphp SAML2 PHP library, version 4.19.2 and 4.20.2, permits an attacker to define XPath transforms during XML signature processing of SAML messages. Because the library does not validate or restrict these transforms, a crafted message can trigger XPath queries that consume excessive CPU or memory. The result is a denial of service that can affect any application or service using the vulnerable library, without needing authentication. The fix, available in 4.19.3 and 4.20.3, limits the number of allowed transforms and rejects XPath transforms outright.

The vulnerability affects the SimpleSAMLphp SAML2 PHP library. The affected versions are 4.19.2 and 4.20.2. Fixes were released in 4.19.3 and 4.20.3, and later releases are presumed to be safe.

The CVSS score of 7.5 indicates a high impact denial of service scenario. The EPSS score is very low (< 1%), suggesting a low probability of active exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a remote unauthenticated attacker sending a specially crafted SAML message that contains a malicious XPath transform, which the library will process during signature verification. If the target application uses the vulnerable library to validate SAML responses, the crafted message can cause the target to exhaust processing resources, leading to a service interruption.