CVE-2026-40988
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
An application using spring-security-saml2-service-provider with the REDIRECT binding for SAML 2.0 Login or Logout may be vulnerable to a denial of service via an unbounded writer that inflates the compressed SAML payload into memory.
Risk Assessment
An attacker can send a crafted SAML request that, upon decompression, consumes excessive memory, leading to resource exhaustion and denial of service for legitimate users.
Recommendation
Immediately upgrade Spring Security to version 5.7.24, 5.8.26, 6.3.17, 6.4.17, 6.5.11, or 7.0.6, depending on the release line in use.
Original NVD description (English source)
An application using spring-security-saml2-service-provider and the REDIRECT binding for SAML 2.0 Login or Logout may be vulnerable to a denial of service by way of an unbounded writer that inflates the compressed SAML payload into memory. Affected versions: Spring Security 5.7.0 through 5.7.23; 5.8.0 through 5.8.25; 6.3.0 through 6.3.16; 6.4.0 through 6.4.16; 6.5.0 through 6.5.10; 7.0.0 through 7.0.5.