CVE-2025-46404 Null dereference in Lasso

High 7.5 Published 5 Nov 2025 Updated 5 Nov 2025

A null pointer dereference in the SAML signature verification allows attackers to cause a denial of service via crafted responses.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2025-46404?

CVE-2025-46404 is a high-severity vulnerability in Entr'ouvert Lasso, published on 5 Nov 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A denial of service vulnerability exists in the lasso_provider_verify_saml_signature functionality of Entr'ouvert Lasso 2.5.1. A specially crafted SAML response can lead to a denial of service. An attacker can send a malformed SAML response to trigger this vulnerability.

Weakness: CWE-476

Which versions are affected by CVE-2025-46404?

It affects 1 product.

Products include Entrouvert Lasso.

How do I fix CVE-2025-46404?

Upgrade to a fixed version.

Is CVE-2025-46404 being exploited?

There is no known exploitation of CVE-2025-46404 in the wild and no public exploit code.

Sources

Also known as AZL-69841, AZL-69854, DEBIAN-CVE-2025-46404, GHSA-2vvf-4m7q-pvpx, UBUNTU-CVE-2025-46404.