CVE-2023-26483: gosaml2 is a Pure Go implementation of SAML 2.0

Q: How do I fix CVE-2023-26483?

gosaml2: upgrade to 0.9.0. Exact commands for each OS are on this page.

Q: Is CVE-2023-26483 being exploited?

CVE-2023-26483 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

Q: What does CVE-2023-26483 affect?

CVE-2023-26483 affects gosaml2. Severity is medium (CVSS 5.3). gosaml2 is a Pure Go implementation of SAML 2.0. SAML Service Providers using this library for SAML authentication support are likely susceptible to Denial of Service attacks. A bug in this library enables attackers to craft a `deflate`-com

Q: How urgent is CVE-2023-26483?

Priority 39/100. Remotely exploitable, no login, no user action

Routine

MEDIUM 5.3REMOTEUPGRADE

CVE-2023-26483 is a medium-severity flaw (CVSS 5.3) affecting gosaml2. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

gosaml2 is a Pure Go implementation of SAML 2.0. SAML Service Providers using this library for SAML authentication support are likely susceptible to Denial of Service attacks. A bug in this library enables attackers to craft a `deflate`-compressed request which will consume significantly more memory during processing than the size of the original request. This may eventually lead to memory exhaustion and the process being killed. The maximum comp

Why this priority

Remotely exploitable, no login, no user action

A fixed release or distro patch exists.

Risk facts

CVSS score	5.3 (Medium)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	None
EPSS exploit chance	1.0% (top 38%)
CISA exploited list	No
Weakness	CWE-409
Published	2023-03-03
Last modified	2026-06-17

Publisher (CNA): GitHub, Inc. · Vendor: gosaml2 project

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2023-03-03 23:15 UTCPublished CVE record published
2026-06-17 05:43 UTCUpdated Record last modified

gosaml2 project gosaml2 UPGRADE

Affected: < 0.9.0

Fixed in: 0.9.0

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy gosaml2 || rpm -q gosaml2 || gosaml2 --version

2. UPGRADE to 0.9.0 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade gosaml2

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade gosaml2

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2023-26483?

gosaml2: upgrade to 0.9.0. Exact commands for each OS are on this page.

Is CVE-2023-26483 being exploited?

CVE-2023-26483 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2023-26483 affect?

CVE-2023-26483 affects gosaml2. Severity is medium (CVSS 5.3). gosaml2 is a Pure Go implementation of SAML 2.0. SAML Service Providers using this library for SAML authentication support are likely susceptible to Denial of Service attacks. A bug in this library enables attackers to craft a `deflate`-com

How urgent is CVE-2023-26483?

Priority 39/100. Remotely exploitable, no login, no user action

References

← Back to latest CVEs