Get ahead
VMware offers training and certification to turbo-charge your progress.
Learn moreUnbounded DEFLATE Inflation in SAML 2.0 Service Provider
Description
An application using spring-security-saml2-service-provider and the REDIRECT binding for SAML 2.0 Login or Logout may be vulnerable to a denial of service by way of an unbounded writer that inflates the compressed SAML payload into memory.
Affected Spring Products and Versions
Spring Security:
- 7.0.0 - 7.0.5
- 6.5.0 - 6.5.10
- 6.4.0 - 6.4.16
- 6.3.0 - 6.3.16
- 5.8.0 - 5.8.25
- 5.7.23 and earlier
Mitigation
Users of affected versions should upgrade to the corresponding fixed version.
| Fix version | Availability |
|---|---|
| 7.0.6 | OSS |
| 7.0.5.1 | Enterprise Support Only |
| 6.5.11 | OSS |
| 6.5.10.2 | Enterprise Support Only |
| 6.4.17 | Enterprise Support Only |
| 6.3.17 | Enterprise Support Only |
| 5.8.26 | Enterprise Support Only |
| 5.7.24 | Enterprise Support Only |
Note that for SAML Login, it is also recommended to disallow SAML Responses in GET requests by using OpenSaml5AuthenticationTokenConverter#setShouldConvertGetRequests(false).
History
- 2026-06-09: Initial vulnerability report published.
Reporting a vulnerability
To report a security vulnerability for a project within the Spring portfolio, see the Security Policy
Get support
Tanzu Spring offers support and binaries for OpenJDK™, Spring, and Apache Tomcat® in one simple subscription.
Learn moreUpcoming events
Check out all the upcoming events in the Spring community.
View all