CVE-2025-46784

A denial of service vulnerability exists in the lasso_node_init_from_message_with_format functionality of Entr'ouvert Lasso 2.5.1. A specially crafted SAML response can lead to a memory depletion, resulting in denial of service. An attacker can send a malformed SAML response to trigger this vulnerability.

Score

CVSS 3.1 7.5 High

Status

Analyzed - talos-cna@cisco.com

Published

2025-11-05

Last modified

2026-10-18

Weaknesses

CWE-401

Affected products

• Lasso (Entrouvert)

References

• https://talosintelligence.com/vulnerability_reports/TALOS-2025-2195
• https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2195