Description

An application using spring-security-saml2-service-provider and the REDIRECT binding for SAML 2.0 Login or Logout may be vulnerable to a denial of service by way of an unbounded writer that inflates the compressed SAML payload into memory.

Affected Spring Products and Versions

Spring Security:

• 5.7.0 - 5.7.23
• 5.8.0 - 5.8.25
• 6.3.0 - 6.3.16
• 6.4.0 - 6.4.16
• 6.5.0 - 6.5.10
• 7.0.0 - 7.0.5
• Older, unsupported versions are also affected.

Mitigation

Users of affected versions should upgrade to the corresponding fixed version.

Note that for SAML Login, it is also recommended to disallow SAML Responses in GET requests by using OpenSaml5AuthenticationTokenConverter#setShouldConvertGetRequests(false).

Credit

The issue was identified and responsibly reported anonymously.

References

• https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C/CR:X/IR:X/AR:M/MAV:N/MAC:L/MPR:N/MUI:N/MS:U/MC:N/MI:N/MA:H&version=3.1

History

• 2026-06-09: Initial vulnerability report published.