CVE-2026-49289 SimpleSAMLphp SAML2: Possible DoS via XPath Transform
Remote unauthenticated attackers can cause denial of service in SimpleSAMLphp SAML2 library by sending crafted SAML messages with XPath transforms.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-49289?
CVE-2026-49289 is a high-severity denial of service vulnerability in simplesamlphp saml2, published on 19 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. In 4.19.2 and 4.20.2, the library permits attacker-controlled XPath transforms while processing XML signatures in specially crafted SAML messages. XPath evaluation can consume uncontrolled processing resources, allowing a remote unauthenticated attacker to deny service to any entity relying on SimpleSAMLphp or directly on the SAML2 library. The mitigation limits the number of transforms, permits only transform algorithms identified by the SAML 2.0 Core specification, and specifically rejects XPath transforms. This issue is fixed in versions 4.19.3 and 4.20.3.
Weakness: CWE-400
Which versions are affected by CVE-2026-49289?
8 open source packages ship an affected version, including simplesamlphp/saml2 and simplesamlphp/saml2-legacy.
| Package | Affected | Fixed in |
|---|---|---|
simplesamlphp/saml2 Packagist | All versions | 4.19.3 |
simplesamlphp/saml2 Packagist | All versions | 4.19.3 |
simplesamlphp/saml2 Packagist | From 4.20.0 | 4.20.3 |
simplesamlphp/saml2 Packagist | From 4.20.0 | 4.20.3 |
simplesamlphp/saml2-legacy Packagist | All versions | 4.19.3 |
simplesamlphp/saml2-legacy Packagist | All versions | 4.19.3 |
2 more packages
simplesamlphp/saml2-legacy Packagist | From 4.20.0 | 4.20.3 |
simplesamlphp/saml2-legacy Packagist | From 4.20.0 | 4.20.3 |
How do I fix CVE-2026-49289?
Upgrade simplesamlphp/saml2 to a fixed version for your release line: 4.19.3 or 4.20.3.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-49289 being exploited?
There is no known exploitation of CVE-2026-49289 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-49289, GHSA-5cjr-mxj5-wmrx, UBUNTU-CVE-2026-49289.