Executive brief
Spring Security is a widely used framework for securing Java-based applications. A vulnerability in its SAML2 login component allows an attacker to crash the application by sending a specially crafted login or logout request. This results in a denial of service, preventing legitimate users from accessing the system and potentially impacting business operations.
Technical details
A denial of service vulnerability exists in the spring-security-saml2-service-provider component of Spring Security. When using the SAML 2.0 REDIRECT binding for login or logout operations, the application uses an unbounded writer to inflate compressed SAML payloads. An unauthenticated remote attacker can exploit this by sending a malicious payload that expands excessively upon decompression, exhausting system memory (RAM). This is a classic 'zip bomb' style attack targeting the SAML inflation process. Patches are available in versions 6.5.11, 7.0.6, and other subsequent maintenance releases.
Affected products
- VMware Spring Security 5.7.0 to 5.7.23, 5.8.0 to 5.8.25, 6.3.0 to 6.3.16, 6.4.0 to 6.4.16, 6.5.0 to 6.5.10, 7.0.0 to 7.0.5
Timeline
- 2026-06-10: disclosed
- 2026-06-10: advisory
- 2026-08-12: patched: Updated advisory with patch versions