A denial of service vulnerability exists in the g_assert_not_reached functionality of Entr'ouvert Lasso 2.5.1 and 2.8.2. A specially crafted SAML assertion response can lead to a denial of service. An attacker can send a malformed SAML response to trigger this vulnerability.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Vendors Products
Entrouvert
  • Lasso

Configuration 1 [-]

OR cpe:2.3:a:entrouvert:lasso:2.5.1:*:*:*:*:*:*:*
cpe:2.3:a:entrouvert:lasso:2.8.2:*:*:*:*:*:*:*

No data.

References
Link Providers
https://nvd.nist.gov/vuln/detail/CVE-2025-46705 cve-icon
https://talosintelligence.com/vulnerability_reports/TALOS-2025-2196 cve-icon cve-icon cve-icon
https://www.cve.org/CVERecord?id=CVE-2025-46705 cve-icon
https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2196 cve-icon cve-icon
History

Fri, 07 Nov 2025 20:15:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:entrouvert:lasso:2.5.1:*:*:*:*:*:*:*
cpe:2.3:a:entrouvert:lasso:2.8.2:*:*:*:*:*:*:*

Fri, 07 Nov 2025 00:15:00 +0000

Type Values Removed Values Added
Title lasso: Denial of service in Entr'ouvert Lasso
References
Metrics threat_severity

None

 threat_severity

Moderate

Thu, 06 Nov 2025 10:15:00 +0000

Type Values Removed Values Added
First Time appeared Entrouvert
Entrouvert lasso
Vendors & Products Entrouvert
Entrouvert lasso

Wed, 05 Nov 2025 22:45:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H'}

 cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Wed, 05 Nov 2025 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 05 Nov 2025 17:30:00 +0000

Type Values Removed Values Added
References

Wed, 05 Nov 2025 15:15:00 +0000

Type Values Removed Values Added
Description A denial of service vulnerability exists in the g_assert_not_reached functionality of Entr'ouvert Lasso 2.5.1 and 2.8.2. A specially crafted SAML assertion response can lead to a denial of service. An attacker can send a malformed SAML response to trigger this vulnerability.
Weaknesses CWE-617
References
Metrics cvssV3_1

{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H'}
cve-icon MITRE

Status: PUBLISHED

Assigner: talos

Published: 2025-11-05T14:56:55.535Z

Updated: 2025-11-05T22:36:34.501Z

Reserved: 2025-05-07T13:20:22.107Z

Link: CVE-2025-46705

cve-icon Vulnrichment

Updated: 2025-11-05T17:04:16.858Z

cve-icon NVD

Status : Analyzed

Published: 2025-11-05T15:15:38.530

Modified: 2025-11-07T20:02:36.453

Link: CVE-2025-46705

cve-icon Redhat

Severity : Moderate

Publid Date: 2025-11-05T14:56:55Z

Links: CVE-2025-46705 - Bugzilla