PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-10127 Pysaml2 Project CVE debrief

CVE-2016-10127 is a critical XML external entity (XXE) issue in PySAML2. A crafted SAML XML request or response can trigger unsafe XML parsing, which may expose sensitive data or otherwise affect confidentiality, integrity, and availability. The NVD record rates the issue 9.0/CRITICAL and maps it to CWE-611.

Vendor
Pysaml2 Project
Product
Pysaml2
CVSS
CRITICAL 9
CISA KEV
Not listed in stored evidence
Original CVE published
2017-03-03
Original CVE updated
2026-05-13
Advisory published
2017-03-03
Advisory updated
2026-05-13

Who should care

Organizations running PySAML2 in SAML identity provider or service provider roles, especially teams responsible for federation endpoints, XML parsing, and application security. Security operations and vulnerability management teams should also prioritize this finding because it is network-reachable in the NVD scoring and carries high impact.

Technical summary

The supplied NVD record identifies CVE-2016-10127 as CWE-611 (XXE) in PySAML2, with the attack vector described as network-based and the CVSS v3.0 vector showing low privileges and user interaction requirements. The vulnerability is triggered by crafted SAML XML request or response content that can cause external entity resolution during parsing. Supplied references include an upstream patch commit, issue tracker entries, and third-party advisories.

Defensive priority

Immediate

Recommended defensive actions

  • Identify all deployments that use PySAML2 and confirm whether they are exposed to untrusted SAML traffic.
  • Apply the upstream fix referenced by the supplied GitHub patch commit and ensure your packaged release includes that remediation.
  • Review XML parser settings and disable external entity processing where applicable, even if the library patch is already applied.
  • Test SAML endpoints in a controlled environment to confirm that entity expansion and external resource resolution are not possible.
  • Prioritize remediation on internet-facing identity and federation services using PySAML2.
  • Track downstream distribution advisories or package updates that incorporate the upstream patch.

Evidence notes

The supplied official NVD record lists CVE-2016-10127 as CWE-611 with CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H and identifies the vulnerable CPE as pysaml2_project:pysaml2. Supporting references in the corpus include the upstream GitHub commit, issue #366, pull request #379, and OSS-security/Debian advisories. The CVE publication date supplied is 2017-03-03; references in the corpus show vulnerability discussion and patch activity before that date.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-10127 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-10127

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-10127 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-10127

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.