CVE catalog
CVE-2026-49289
The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. In 4.19.2 and 4.20.2, the library permits attacker-controlled XPath transforms while processing XML signatures in spec
- Severity
- High · CVSS 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 0.78% · Oct 25, 2026
The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. In 4.19.2 and 4.20.2, the library permits attacker-controlled XPath transforms while processing XML signatures in specially crafted SAML messages. XPath evaluation can consume uncontrolled processing resources, allowing a remote unauthenticated attacker to deny service to any entity relying on SimpleSAMLphp or directly on the SAML2 library. The mitigation limits the number of transforms, permits only transform algorithms identified by the SAML 2.0 Core specification, and specifically rejects XPath transforms. This issue is fixed in versions 4.19.3 and 4.20.3.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | simplesamlphp | sid | 2.5.3.1-1 | vulnerable |
| Debian | simplesamlphp | forky | 2.5.3.1-1 | vulnerable |
| Debian | simplesamlphp | bookworm | 1.19.7-1+deb12u2 | vulnerable |
| Debian | simplesamlphp | bookworm-security | 1.19.7-1+deb12u1 | vulnerable |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | simplesamlphp | source | sid | (unfixed) | not yet assigned | Not reported | Not reported |
| Debian | simplesamlphp | source | forky | (unfixed) | not yet assigned | Not reported | Not reported |
| Debian | simplesamlphp | source | bookworm | (unfixed) | not yet assigned | Not reported | Not reported |
Notes
[bookworm] simplesamlphp: Minor issue; low popcon
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [simplesamlphp]Affected
Details (4)
1.19.7-1+deb12u2· all · bookwormAffected
nvd · simplesamlphp · debian · bookworm; nvd · simplesamlphp · debian · 12
1.19.7-1+deb12u2· all · bookwormAffected
nvd · simplesamlphp · debian · bookworm; nvd · simplesamlphp · debian · 12
1.19.7-1+deb12u1· all · bookworm-securityAffected
nvd · simplesamlphp · debian · bookworm; nvd · simplesamlphp · debian · 12
1.19.7-1+deb12u1· all · bookworm-securityAffected
nvd · simplesamlphp · debian · bookworm; nvd · simplesamlphp · debian · 12
Observed: