CVE-2026-40988: Spring Security SAML2 DoS Vulnerability

CVE-2026-40988 Overview

CVE-2026-40988 affects applications using spring-security-saml2-service-provider with the REDIRECT binding for SAML 2.0 Login or Logout. The vulnerability allows remote attackers to trigger a denial of service condition by submitting compressed SAML payloads that inflate to unbounded sizes in memory. The root weakness is classified as [CWE-400] Uncontrolled Resource Consumption. An attacker can send a crafted SAML message over the network without authentication or user interaction, exhausting available memory on the service provider.

Critical Impact
Unauthenticated remote attackers can exhaust application memory through compressed SAML payloads, causing denial of service to all users of affected Spring Security deployments.

Affected Products

Spring Security 5.7.0 through 5.7.23 and 5.8.0 through 5.8.25
Spring Security 6.3.0 through 6.3.16, 6.4.0 through 6.4.16, and 6.5.0 through 6.5.10
Spring Security 7.0.0 through 7.0.5

Discovery Timeline

2026-06-10 - CVE-2026-40988 published to the National Vulnerability Database (NVD)
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-40988

Vulnerability Analysis

The vulnerability resides in the SAML 2.0 REDIRECT binding handler inside spring-security-saml2-service-provider. SAML messages transmitted over the REDIRECT binding are DEFLATE-compressed and Base64-encoded before being placed in URL query parameters. When the service provider receives such a message, it decodes and inflates the payload to parse the underlying XML.

The flaw is that the inflation routine writes the decompressed output into an unbounded in-memory writer. An attacker can construct a highly compressible payload, often called a decompression bomb, where a small input expands into hundreds of megabytes or gigabytes of XML data. Processing this payload exhausts heap memory and degrades or crashes the application.

Root Cause

The root cause is the absence of a size limit on the inflater output. The library trusts that compressed SAML payloads expand to a reasonable size. No bounded buffer, byte counter, or maximum expansion ratio guards the decompression step, so memory consumption scales directly with attacker-controlled input.

Attack Vector

The attack vector is network-based and unauthenticated. An attacker crafts a DEFLATE-compressed SAML AuthnRequest, Response, or LogoutRequest containing repetitive XML structures that compress to a small payload but expand massively. The attacker then sends the payload to a Spring Security SAML 2.0 endpoint that accepts the REDIRECT binding. Repeated requests amplify the impact and can fully exhaust application memory. See the Spring Security Advisory for CVE-2026-40988 for vendor technical details.

Detection Methods for CVE-2026-40988

Indicators of Compromise

Sudden Java heap exhaustion or OutOfMemoryError exceptions in application logs correlated with SAML endpoint traffic
HTTP GET requests to SAML SSO or SLO endpoints containing unusually large SAMLRequest or SAMLResponse query parameters
Repeated requests from a single source to /login/saml2/sso/* or /logout/saml2/slo URLs followed by application instability

Detection Strategies

Inspect access logs for SAML REDIRECT binding requests where the decoded payload exceeds expected size thresholds for typical assertions
Monitor JVM heap usage and garbage collection metrics for anomalous spikes that align with inbound SAML traffic
Correlate web application firewall logs with backend memory pressure events to identify decompression bomb patterns

Monitoring Recommendations

Enable application performance monitoring for memory and thread metrics on hosts running Spring Security SAML service providers
Alert on consecutive OutOfMemoryError or container restarts on authentication services
Capture and retain inbound SAML payloads for forensic analysis when memory anomalies occur

How to Mitigate CVE-2026-40988

Immediate Actions Required

Upgrade Spring Security to a patched version aligned with your current release line as documented in the Spring Security advisory
Inventory all applications consuming spring-security-saml2-service-provider and confirm whether REDIRECT binding is enabled for Login or Logout
Apply WAF or reverse proxy rules to limit the size of SAMLRequest and SAMLResponse query parameters

Patch Information

Upgrade to a fixed Spring Security release as published in the Spring Security Advisory for CVE-2026-40988. Patched releases bound the inflater output to a safe maximum size and reject payloads that exceed it.

Workarounds

Switch from the REDIRECT binding to the POST binding for SAML 2.0 Login and Logout where the identity provider supports it
Place a reverse proxy in front of the service provider that enforces a strict maximum query string length on SAML endpoints
Restrict access to SAML endpoints to known identity provider source networks where feasible

bash

# Example nginx configuration to cap SAML REDIRECT payload size
location ~ ^/(login|logout)/saml2/ {
    if ($args ~* "SAML(Request|Response)=.{8000,}") {
        return 413;
    }
    proxy_pass http://spring_app_backend;
}