{"record":{"id":"960087b52cc31569","repo":"spring-projects/spring-security","slug":"saml-payload-exceeded-maximum-size-of-960087","errorCode":null,"errorMessage":"SAML payload exceeded maximum size of ","messagePattern":"SAML payload exceeded maximum size of ","errorType":"validation","errorClass":"IOException","httpStatus":null,"severity":"warning","filePath":"saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/web/authentication/Saml2Utils.java","lineNumber":212,"sourceCode":"\n\t}\n\n\tstatic class CappedOutputStream extends OutputStream {\n\n\t\tprivate static final long MAX_SIZE = 1024 * 1024;\n\n\t\tprivate final OutputStream delegate;\n\n\t\tprivate int size;\n\n\t\tCappedOutputStream(OutputStream delegate) {\n\t\t\tthis.delegate = delegate;\n\t\t}\n\n\t\t@Override\n\t\tpublic void write(int b) throws IOException {\n\t\t\tif (this.size >= MAX_SIZE) {\n\t\t\t\tthrow new IOException(\"SAML payload exceeded maximum size of \" + MAX_SIZE);\n\t\t\t}\n\t\t\tthis.delegate.write(b);\n\t\t\tthis.size++;\n\t\t}\n\n\t}\n\n}\n","sourceCodeStart":194,"sourceCodeEnd":221,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/web/authentication/Saml2Utils.java#L194-L221","documentation":"Thrown by the internal CappedOutputStream while base64-decoding an incoming SAMLResponse: the decoded payload exceeded the hard maximum size (MAX_SIZE, a decompression-bomb guard). The library deliberately aborts rather than buffering an unbounded payload. It is a security control, not a bug.","triggerScenarios":"A SAMLResponse form parameter whose decoded length exceeds Saml2Utils' MAX_SIZE cap is passed to Saml2Utils.decode, e.g. an attacker-supplied oversized payload or an unusually huge response (giant attributes, embedded base64 blobs) from a misbehaving IDP.","commonSituations":"Malicious/fuzzed requests hitting the SSO endpoint; an IDP configured with enormous attribute statements; test harness posting very large fake responses.","solutions":["Confirm the payload is legitimate; a truly oversized SAMLResponse from a trusted IDP usually indicates a misconfiguration at the IDP (limit attribute sizes)","If a larger cap is genuinely required, upgrade Spring Security — the cap is internal; otherwise split/reduce assertion content at the IDP","Treat unexpected oversized payloads as attacks: reject, log source IP, and monitor the endpoint","Ensure clients cannot bypass the normal filter chain and feed Saml2Utils directly"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"if (samlResponseParam != null && samlResponseParam.length() > 100_000) {\n    log.warn(\"Oversized SAMLResponse rejected before processing\");\n    response.sendError(HttpServletResponse.SC_BAD_REQUEST);\n    return;\n}","typeGuard":null,"tryCatchPattern":"try { /* saml processing */ } catch (IOException ex) {\n    log.warn(\"SAML payload size limit exceeded\", ex);\n    response.sendError(HttpServletResponse.SC_BAD_REQUEST);\n}","preventionTips":["Limit request body sizes at the web server/reverse proxy","Cap IDP attribute statement sizes","Monitor oversized requests to the SSO endpoint as attack signals"],"tags":["saml2","spring-security","payload-too-large","security"],"backgroundTag":"payload-too-large","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}