CRITICALGo
GHSA-5684-g483-2249Signature Validation Bypass
Modified: 10/5/2021
package
Go/github.com/russellhaering/gosaml2
pkg:go/github.com/russellhaering/gosaml2
MEDIUM5.3Go
GHSA-6gc3-crp7-25w5· CVE-2023-26483, GO-2023-1602gosaml2 vulnerable to Denial Of Service Via Deflate Decompression Bomb
Modified: 9/10/2026
HIGHGo
GHSA-hwqm-qvj9-4jr2· GO-2026-4760gosaml2 CBC Padding Panic — Unauthenticated Process Crash
Modified: 9/10/2026
HIGH7.5Go
GHSA-mqqv-chpx-vq25· CVE-2020-7711, CVE-2020-7731goxmldsig vulnerable to crash on nil-pointer dereference caused by sending malformed XML signatures
Modified: 7/8/2026
HIGH7.5Go
GHSA-pcgw-qcv5-h8ch· GO-2026-4764Unsigned SAML LogoutRequest Acceptance in gosaml2
Modified: 9/10/2026
HIGH7.5Go
GHSA-prjq-f4q3-fvfr· CVE-2020-7711, CVE-2020-7731github.com/russellhaering/gosaml2 is vulnerable to NULL Pointer Dereference
Modified: 7/8/2026
CRITICAL9.8Go
GHSA-xhqq-x44f-9fgg· BIT-golang-2020-29509, CVE-2020-29509Authentication Bypass in github.com/russellhaering/gosaml2
Modified: 9/10/2026
—Go
GO-2020-0046· CVE-2020-7711, CVE-2020-7731Panic due to malformed XML digital signature in github.com/russellhaering/goxmldsig
Modified: 7/8/2026
—Go
GO-2021-0060· BIT-golang-2020-29509, CVE-2020-29509Authentication bypass in github.com/russellhaering/gosaml2
Modified: 2/4/2026
—Go
GO-2023-1602· CVE-2023-26483, GHSA-6gc3-crp7-25w5Denial of service via deflate decompression bomb in github.com/russellhaering/gosaml2
Modified: 5/20/2024
—Go
GO-2026-4760· GHSA-hwqm-qvj9-4jr2CBC Padding Panic — Unauthenticated Process Crash in github.com/russellhaering/gosaml2
Modified: 3/30/2026
—Go
GO-2026-4764· GHSA-pcgw-qcv5-h8chUnsigned SAML LogoutRequest Acceptance in gosaml2 in github.com/russellhaering/gosaml2
Modified: 3/30/2026