-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/crewjam/saml | go | < 0.4.13 | 0.4.13 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from direct use of flate.NewReader in SAML request/response processing paths without size limitations. The patch replaces these with newSaferFlateReader that enforces a 10MB limit. The affected functions are clearly shown in the diff:- identity_provider.go line 363 (SAMLRequest handling)- service_provider.go line 1524 (logout response validation). Both locations decompressed user-controlled input without resource constraints, matching the CWE-770 description of unlimited allocation.