PatchTheCVElasso vulnerabilities and fixes
Recent CVEs affecting lasso, with upgrade or downgrade steps. 4 tracked.
lasso has 4 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 1. Most recent: 2025-11-05. Highest priority: CVE-2025-47151 (score 61/100).
- CVE-2025-47151 CRITICAL 9.8 DOWNGRADE A type confusion vulnerability exists in the lasso_node_impl_init_from_xml functionality of Entr'ouvert La
- CVE-2025-46404 HIGH 7.5 DOWNGRADE A denial of service vulnerability exists in the lasso_provider_verify_saml_signature functionality of Entr'
- CVE-2025-46705 HIGH 7.5 DOWNGRADE A denial of service vulnerability exists in the g_assert_not_reached functionality of Entr'ouvert Lasso 2.
- CVE-2025-46784 HIGH 7.5 DOWNGRADE A denial of service vulnerability exists in the lasso_node_init_from_message_with_format functionality of Entr
FAQ
How do I fix lasso vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is lasso being exploited right now?
None of the tracked lasso CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which lasso CVE should I patch first?
CVE-2025-47151 currently ranks highest (61/100): A type confusion vulnerability exists in the lasso_node_impl_init_from_xml functionality of Entr'ouvert La.