CVE-2026-40988: Unbounded DEFLATE Inflation in SAML 2.0 Service Provider

Synopsis

An unbounded DEFLATE decompression vulnerability affects the SAML 2.0 Service Provider component in Spring Security (spring-security-saml2-service-provider). The flaw is reachable over the network with no authentication required, triggered by sending a specially crafted compressed SAML payload via the REDIRECT binding during Login or Logout flows. Successful exploitation exhausts process memory, causing a denial of service. Patched-image rebuilds at versions 5.7.24, 5.8.26, 6.3.17, 6.4.17, and 6.5.11 are available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The SAML REDIRECT binding endpoint must be reachable over the network; an attacker sends the malicious payload directly to the exposed login or logout URL.

• AuthenticationNot required

  No account or session is needed; the vulnerable endpoint processes unauthenticated SAML redirect requests by design.

• Victim interactionNot required

  No user action is required; the attacker submits the crafted request directly to the service.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and imposes no special preconditions, race conditions, or environmental dependencies.

Blast Radius

• The affected service runs out of memory while inflating the oversized DEFLATE payload, crashing the process or making it unresponsive.
• All users of the application lose access to authenticated sessions and the login or logout flow until the service is restarted.
• Repeated requests can prevent recovery and keep the service in a continuous denial-of-service state without any persistence on the host.