# CVE-2026-40988: VMware Spring Security DoS in SAML 2.0 Service Provider

Source: https://junglewise.ai/threats/cve-2026-40988-vmware-spring-security-dos-in-saml-2-0-service-provider  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-10. Updated: 2026-08-12  
License: CC BY 4.0 with a link back

CVE-2026-40988 · Severity: high · CVSS 7.5 · Published 2026-06-10

Spring Security is a widely used framework for securing Java-based applications. A vulnerability in its SAML2 login component allows an attacker to crash the application by sending a specially crafted login or logout request. This results in a denial of service, preventing legitimate users from accessing the system and potentially impacting business operations.

Technologies: [org.springframework.security:spring-security-saml2-service-provider (Maven)](https://junglewise.ai/threats/technologies/org-springframework-security-spring-security-saml2-service-provider), [VMware Spring Security](https://junglewise.ai/threats/technologies/spring-security). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven), [VMware](https://junglewise.ai/threats/vendors/vmware).

## Quick answers

**Is CVE-2026-40988 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40988 being exploited in the wild.

**How severe is CVE-2026-40988?** High severity, with a CVSS score of 7.5, published 10 June 2026.

**Which products and versions are affected?** org.springframework.security:spring-security-saml2-service-provider (Maven) ECOSYSTEM:introduced=7.0.0,fixed=7.0.6; VMware Spring Security 5.7.0 to 5.7.23, 5.8.0 to 5.8.25, 6.3.0 to 6.3.16, 6.4.0 to 6.4.16, 6.5.0 to 6.5.10, 7.0.0 to 7.0.5.

**Is there a fix for CVE-2026-40988?** Yes. org.springframework.security:spring-security-saml2-service-provider (Maven): upgrade to 7.0.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-40988 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-40988?** Check whether you run org.springframework.security:spring-security-saml2-service-provider (Maven) or VMware Spring Security at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.springframework.security:spring-security-saml2-service-provider (Maven): upgrade to 7.0.6 or later

  ```sh
  # set org.springframework.security:spring-security-saml2-service-provider to 7.0.6 in your pom.xml or build.gradle
  ```


## Technical details

A denial of service vulnerability exists in the spring-security-saml2-service-provider component of Spring Security. When using the SAML 2.0 REDIRECT binding for login or logout operations, the application uses an unbounded writer to inflate compressed SAML payloads. An unauthenticated remote attacker can exploit this by sending a malicious payload that expands excessively upon decompression, exhausting system memory (RAM). This is a classic 'zip bomb' style attack targeting the SAML inflation process. Patches are available in versions 6.5.11, 7.0.6, and other subsequent maintenance releases.

## Affected products

- VMware Spring Security 5.7.0 to 5.7.23, 5.8.0 to 5.8.25, 6.3.0 to 6.3.16, 6.4.0 to 6.4.16, 6.5.0 to 6.5.10, 7.0.0 to 7.0.5

## Identifiers

- CVE-2026-40988
- GHSA-m69x-pw9p-7j3q

## Timeline

- 2026-06-10: disclosed
- 2026-06-10: advisory
- 2026-08-12: patched: Updated advisory with patch versions

## References

- [https://spring.io/security/cve-2026-40988](https://spring.io/security/cve-2026-40988)
- [https://github.com/spring-projects/spring-security/releases/tag/6.5.11](https://github.com/spring-projects/spring-security/releases/tag/6.5.11)
- [https://github.com/spring-projects/spring-security/releases/tag/7.0.6](https://github.com/spring-projects/spring-security/releases/tag/7.0.6)

## Related threats

- [Spring Security InetAddressMatchers IP classification bypass](https://junglewise.ai/threats/cve-2026-59277-spring-security-inetaddressmatchers-ip-classification-bypass)
- [Spring Security timing attack on security-sensitive string comparison](https://junglewise.ai/threats/cve-2026-59276-spring-security-timing-attack-on-security-sensitive-string)
- [Spring Security OAuth2 Authorization Server metadata validation in Dynamic Client Registration](https://junglewise.ai/threats/cve-2026-59354-spring-security-oauth2-authorization-server-metadata-validation)
- [Spring Security embedded UnboundID LDAP server authentication bypass](https://junglewise.ai/threats/cve-2026-59270-spring-security-embedded-unboundid-ldap-server-authentication)
- [Spring Security WebAuthn user verification bypass in distributed sessions](https://junglewise.ai/threats/cve-2026-47841-spring-security-webauthn-user-verification-bypass-in-distributed)