CVE-2023-26483

CVE-2023-26483 affects the Go library gosaml2 (SAML 2.0 implementation). A bug allows attackers to craft a deflate-compressed request that can consume memory far beyond the original size, potentially causing memory exhaustion and process termination (a deflate decompression bomb). The maximal obs...

CVE-2020-7731

The CVE-2020-7731 issue affects github.com/russellhaering/gosaml2 versions prior to 0.7.0, causing a nil-pointer dereference when processing malformed XML signatures. The vulnerability is fixed in v0.7.0 (released Mar 2, 2022). Remediation: upgrade to 0.7.0 or later. Workarounds mentioned in rela...