CVE-2025-46784: High severity Entr'ouvert Lasso vulnerability

Published Nov 5, 2025

Updated

A denial of service vulnerability exists in the lassonodeinitfrommessagewithformat functionality of Entr'ouvert Lasso 2.5.1. A specially crafted SAML response can lead to a memory depletion, resulting in denial of service. An attacker can send a malformed SAML response to trigger this vulnerability.

Affected Software

2 affected components

Entr'ouvert Lasso

Entrouvert Lasso=2.5.1

Event History

Nov 5, 2025

CVE Published

via MITRE·02:56 PM

Data Sourced

via MITRE·02:56 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-46784?

CVE-2025-46784 is considered a denial of service vulnerability due to its potential to cause memory depletion.

How do I fix CVE-2025-46784?

To mitigate CVE-2025-46784, updating Entr'ouvert Lasso to the latest version that addresses this vulnerability is recommended.

What causes CVE-2025-46784?

CVE-2025-46784 is caused by a specially crafted SAML response that triggers memory depletion during the processing of messages.

Which software is affected by CVE-2025-46784?

CVE-2025-46784 affects Entr'ouvert Lasso version 2.5.1.

Can CVE-2025-46784 be exploited remotely?

Yes, an attacker can exploit CVE-2025-46784 remotely by sending a malformed SAML response.