{"record":{"id":"3232decc3a6538df","repo":"spring-projects/spring-security","slug":"saml-payload-exceeded-maximum-size-of-3232de","errorCode":null,"errorMessage":"SAML payload exceeded maximum size of ","messagePattern":"SAML payload exceeded maximum size of ","errorType":"validation","errorClass":"IOException","httpStatus":null,"severity":"warning","filePath":"saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/web/authentication/logout/Saml2Utils.java","lineNumber":212,"sourceCode":"\n\t}\n\n\tstatic class CappedOutputStream extends OutputStream {\n\n\t\tprivate static final long MAX_SIZE = 1024 * 1024;\n\n\t\tprivate final OutputStream delegate;\n\n\t\tprivate int size;\n\n\t\tCappedOutputStream(OutputStream delegate) {\n\t\t\tthis.delegate = delegate;\n\t\t}\n\n\t\t@Override\n\t\tpublic void write(int b) throws IOException {\n\t\t\tif (this.size >= MAX_SIZE) {\n\t\t\t\tthrow new IOException(\"SAML payload exceeded maximum size of \" + MAX_SIZE);\n\t\t\t}\n\t\t\tthis.delegate.write(b);\n\t\t\tthis.size++;\n\t\t}\n\n\t}\n\n}\n","sourceCodeStart":194,"sourceCodeEnd":221,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/web/authentication/logout/Saml2Utils.java#L194-L221","documentation":"The logout-side CappedOutputStream size guard: the incoming SAML logout message, once decoded, exceeds the maximum allowed size, so an IOException('SAML payload exceeded maximum size of ' + MAX_SIZE) is thrown. This is a decompression-bomb / DoS protection, not an application bug.","triggerScenarios":"A SAMLLogoutRequest/SAMLLogoutResponse parameter whose decoded size exceeds MAX_SIZE is fed to the logout Saml2Utils decode path — oversized attack payloads or abnormally large logout messages.","commonSituations":"Malicious requests to the SingleLogout endpoint; fuzz testing; an IDP embedding huge NameID/extension data in logout messages.","solutions":["Treat as an attack signal: reject, log, and rate-limit the SLO endpoint","If a legitimate IDP really needs larger logout messages, reduce message size at the IDP (trim attributes/extensions) or upgrade Spring Security if the cap was raised","Verify no client code calls the decode utility directly with untrusted unbounded input"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"if (sloParam != null && sloParam.length() > 100_000) {\n    response.sendError(HttpServletResponse.SC_BAD_REQUEST);\n    return;\n}","typeGuard":null,"tryCatchPattern":"try { /* logout processing */ } catch (IOException ex) {\n    log.warn(\"SAML logout payload size limit exceeded\", ex);\n    response.sendError(HttpServletResponse.SC_BAD_REQUEST);\n}","preventionTips":["Rate-limit the SLO endpoint","Keep logout messages minimal at the IDP","Treat oversized messages as potential DoS and alert"],"tags":["saml2","spring-security","logout","payload-too-large","security"],"backgroundTag":"payload-too-large","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}