UBUNTU-CVE-2026-49289

The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. In 4.19.2 and 4.20.2, the library permits attacker-controlled XPath transforms while processing XML signatures in specially crafted SAML messages. XPath evaluation can consume uncontrolled processing resources,...

CVE-2026-49289

The simplesamlphp/saml2 library (versions 4.19.2 and 4.20.2) permits attacker-controlled XPath transforms during XML signature processing, allowing a remote unauthenticated attacker to consume excessive resources and cause denial of service. The fix caps transform count and rejects XPath transfor...