github.com/crewjam/saml (Go)

SAML library for go

Advisories

Latest version

v0.5.1

Released Apr 14, 2025

License

BSD-2-Clause

OpenSSF Scorecard

3.3 / 10

How to fix

Upgrading to 0.4.14 or later clears every advisory below that has a fix.

Upgrade commands

go get github.com/crewjam/saml@v0.5.1 && go mod tidy

Known vulnerabilities

Advisory	Severity	Affected	Fixed in
GHSA-267v-3v32-g6q5 Cross-site Scripting via missing Binding syntax validation	Medium EPSS 0.48%	`< 0.4.14`	`0.4.14`
GHSA-267v-3v32-g6q5 Cross-site Scripting via missing Binding syntax validation	Medium EPSS 0.48%	`< 0.4.14`	`0.4.14`
GHSA-5mqj-xc49-246p crewjam/saml vulnerable to Denial Of Service Via Deflate Decompression Bomb	High EPSS 0.96%	`< 0.4.13`	`0.4.13`
GHSA-5mqj-xc49-246p crewjam/saml vulnerable to Denial Of Service Via Deflate Decompression Bomb	High EPSS 0.96%	`< 0.4.13`	`0.4.13`
GHSA-j2jp-wvqg-wc2g crewjam/saml vulnerable to signature bypass via multiple Assertion elements due to improper authentication	Critical EPSS 2.33%	`< 0.4.9`	`0.4.9`
GHSA-j2jp-wvqg-wc2g crewjam/saml vulnerable to signature bypass via multiple Assertion elements due to improper authentication	Critical EPSS 2.33%	`< 0.4.9`	`0.4.9`
GHSA-4hq8-gmxx-h6w9 XML Processing error in github.com/crewjam/saml	Critical EPSS 4.93%	`< 0.4.3`	`0.4.3`
GHSA-4hq8-gmxx-h6w9 XML Processing error in github.com/crewjam/saml	Critical EPSS 4.93%	`< 0.4.3`	`0.4.3`
GHSA-4hq8-gmxx-h6w9 XML Processing error in github.com/crewjam/saml	Critical EPSS 4.93%	`< 0.4.3`	`0.4.3`

Source: https://github.com/crewjam/saml

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor