Entr'ouvert Lasso Denial-of-Service Vulnerability in SAML Response Handling

A denial-of-service vulnerability has been identified in Entr'ouvert Lasso version 2.5.1, specifically within the 'lasso_node_init_from_message_with_format' function. This vulnerability arises when a specially crafted SAML response is processed, leading to memory exhaustion and causing a denial-of-service condition. The issue can be triggered by sending a malformed SAML response to the application.

Impact

Exploitation of this vulnerability leads to memory depletion, causing a denial-of-service condition where the application becomes unresponsive or unavailable.

Remediation

Users can update to the patched version of Entr'ouvert Lasso released on August 12, 2025.