Unbounded DEFLATE Inflation in SAML 2.0 Service Provider

Summary

An application using spring-security-saml2-service-provider and the REDIRECT binding for SAML 2.0 Login or Logout may be vulnerable to a denial of service by way of an unbounded writer that inflates the compressed SAML payload into memory. Affected versions: Spring Security 5.7.0 through 5.7.23; 5.8.0 through 5.8.25; 6.3.0 through 6.3.16; 6.4.0 through 6.4.16; 6.5.0 through 6.5.10; 7.0.0 through 7.0.5.

Timeline

1. Jun 9, 2026, 11:46 PM UTCCVE published
2. Jun 10, 2026, 6:08 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: yes · Technical impact: partial

3. Jun 27, 2026, 9:22 PM UTCRecord last updated

Affected versions

• Spring Spring Security

  From 5.7.0 · fixed in 5.7.24; From 5.8.0 · fixed in 5.8.26; From 6.3.0 · fixed in 6.3.17; From 6.4.0 · fixed in 6.4.17; From 6.5.0 · fixed in 6.5.10.2; From 7.0.0 · fixed in 7.0.5.1

• org.springframework.security:spring-security-saml2-service-providerMaven

  From 7.0.0 · fixed in 7.0.6

• org.springframework.security:spring-security-saml2-service-providerMaven

  From 6.5.0 · fixed in 6.5.11

• org.springframework.security:spring-security-saml2-service-providerMaven

  From 6.4.0 · through 6.4.16

• org.springframework.security:spring-security-saml2-service-providerMaven

  From 6.3.0 · through 6.3.16

• org.springframework.security:spring-security-saml2-service-providerMaven

  From 5.8.0 · through 5.8.25

• org.springframework.security:spring-security-saml2-service-providerMaven

  through 5.7.23

References 1