{"record":{"id":"70636c7e46639564","repo":"spring-projects/spring-security","slug":"saml-payload-exceeded-maximum-size-of-70636c","errorCode":null,"errorMessage":"SAML payload exceeded maximum size of ","messagePattern":"SAML payload exceeded maximum size of ","errorType":"validation","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/web/Saml2Utils.java","lineNumber":212,"sourceCode":"\n\t}\n\n\tstatic class CappedOutputStream extends OutputStream {\n\n\t\tprivate static final long MAX_SIZE = 1024 * 1024;\n\n\t\tprivate final OutputStream delegate;\n\n\t\tprivate int size;\n\n\t\tCappedOutputStream(OutputStream delegate) {\n\t\t\tthis.delegate = delegate;\n\t\t}\n\n\t\t@Override\n\t\tpublic void write(int b) throws IOException {\n\t\t\tif (this.size >= MAX_SIZE) {\n\t\t\t\tthrow new IOException(\"SAML payload exceeded maximum size of \" + MAX_SIZE);\n\t\t\t}\n\t\t\tthis.delegate.write(b);\n\t\t\tthis.size++;\n\t\t}\n\n\t}\n\n}\n","sourceCodeStart":194,"sourceCodeEnd":221,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/web/Saml2Utils.java#L194-L221","documentation":"Saml2Utils wraps its output stream in a CappedOutputStream that counts written bytes and aborts once they exceed MAX_SIZE, protecting against decompression-bomb attacks when inflating SAML payloads. When the inflated data would exceed the cap, write() throws IOException('SAML payload exceeded maximum size of ' + MAX_SIZE), which callers wrap into 'Unable to inflate string'.","triggerScenarios":"Inflating (samlInflate / withDecoded(...).inflate()) a compressed SAML payload whose decompressed size exceeds MAX_SIZE — either a legitimately huge payload or a malicious decompression bomb submitted to a redirect-binding endpoint.","commonSituations":"An attacker sends a small highly-compressible SAMLRequest to exhaust memory (the attack this cap exists for); an unusually large signed response (big metadata/embedded certs) legitimately exceeds the limit in an older Spring Security version; repeated retries with the same oversized malicious payload from a vulnerability scanner.","solutions":["Treat this as suspicious input: log the source IP and reject the request with HTTP 400 rather than retrying.","If legitimate payloads genuinely exceed the cap, upgrade Spring Security — MAX_SIZE has been raised in newer versions — or use a version whose limit fits your largest real payload.","Do not remove or enlarge the cap blindly; instead validate/trust the sender (signature verification happens after decode) before accepting larger payloads.","Catch Saml2Exception/IOException around inflate and return a generic 400 to avoid leaking internals."],"exampleFix":"// before (default cap too small for legit large responses)\nString xml = Saml2Utils.samlInflate(decoded); // IOException: exceeded maximum size\n// after\n// upgrade dependency so MAX_SIZE accommodates legit payloads\n// implementation 'org.springframework.security:spring-security-saml2-service-provider:5.8.x/6.x'\n// and add handling:\ntry { xml = Saml2Utils.samlInflate(decoded); }\ncatch (Saml2Exception e) { response.sendError(HttpServletResponse.SC_BAD_REQUEST); return; }","handlingStrategy":"try-catch","validationCode":"if (b64 != null && b64.length() > EXPECTED_MAX_B64_LENGTH) { response.sendError(400); return; }","typeGuard":null,"tryCatchPattern":"try {\n    String xml = Saml2Utils.samlInflate(decoded);\n} catch (Saml2Exception | IOException ex) {\n    securityLog.warn(\"Possible decompression bomb from \" + request.getRemoteAddr());\n    response.sendError(HttpServletResponse.SC_BAD_REQUEST);\n}","preventionTips":["Keep the size cap enabled; never remove it for production endpoints","Log and alert on repeated oversized payloads per source IP","Keep Spring Security updated so the cap reflects current upstream limits","Perform signature verification before trusting large payloads"],"tags":["saml2","spring-security","decompression-bomb","security"],"backgroundTag":"payload-too-large","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}