A critical denial of service vulnerability in Entr'ouvert Lasso 2.5.1 exposes systems to potential service outages through memory exhaustion.

This vulnerability is caused by an improper release of memory (CWE-401) within the lasso_node_init_from_message_with_format function, which can be triggered by an unauthenticated attacker sending a specially crafted SAML response.

The vulnerability carries a CVSS score of 7.5, indicating a high severity risk due to the potential for complete service interruption. Successful exploitation results in memory depletion, leading to a denial of service that can disrupt business operations, impact authentication workflows, and require manual service intervention to restore availability.

Immediate Action: Contact the vendor immediately to obtain the appropriate security patch or update for the Lasso library.

Proactive Monitoring: Monitor system memory usage and server logs for spikes in resource consumption or recurring service crashes associated with SAML processing.

Compensating Controls: Implement rate limiting and input validation at the Web Application Firewall level to drop malformed or oversized SAML responses before they reach the processing engine.

Public Exploit Available: Unknown.

Given the high CVSS score and the potential for significant service disruption, this vulnerability should be prioritized for remediation. IT teams must verify if their environment utilizes the affected version of Lasso and engage the vendor for the required update, while simultaneously hardening the network perimeter against malformed SAML traffic.