Skip to content
Threat Feed
Subscribe

Product

Composer/Simplesamlphp/Saml2-Legacy <= 4.20.2

1 brief RSS
medium advisory

SimpleSAMLphp Vulnerable to Denial-of-Service via Malicious XPath Transform

SimpleSAMLphp and its SAML2 library are vulnerable to CVE-2026-49289, allowing attackers to perform a Denial-of-Service attack by sending specially crafted SAML messages containing XPath transforms, leading to resource exhaustion and service unavailability.

composer/simplesamlphp/saml2 <= 4.20.2 +1 denial-of-service vulnerability saml php
1t