AIKIDO-2026-11177
spring-security-saml2-service-provider is vulnerable to Uncontrolled Resource Consumption
55
Medium Risk
This Affects:
spring-security-saml2-service-providerTL;DR
An application using spring-security-saml2-service-provider and the REDIRECT binding for SAML 2.0 Login or Logout may be vulnerable to a denial of service by way of an unbounded writer that inflates the compressed SAML payload into memory.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
spring-security-saml2-service-provider is vulnerable to Uncontrolled Resource Consumption in versions 0.0.1 - 5.7.23, 5.8.0 - 5.8.25, 6.0.0 - 6.3.16, 6.4.0 - 6.4.16, 6.5.0 - 6.5.10 and 7.0.0 - 7.0.5.
How to fix this
Upgrade the org.springframework.security:spring-security-saml2-service-provider library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant