ruby-saml versions prior to 1.12.4 and from 1.13.0 up to but not including 1.18.0 are vulnerable to a remote Denial of Service (DoS) caused by compressed SAML responses. The vulnerability arises because ruby-saml uses zlib to decompress SAML responses and checks the message size before decompression, allowing attackers to bypass size checks and trigger resource exhaustion.