{"record":{"id":"d6e8d78d885b160d","repo":"spring-projects/spring-security","slug":"unable-to-deflate-string-d6e8d7","errorCode":null,"errorMessage":"Unable to deflate string","messagePattern":"Unable to deflate string","errorType":"exception","errorClass":"Saml2Exception","httpStatus":null,"severity":"error","filePath":"saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/metadata/Saml2Utils.java","lineNumber":61,"sourceCode":"\n\tstatic String samlEncode(byte[] b) {\n\t\treturn Base64.getEncoder().encodeToString(b);\n\t}\n\n\tstatic byte[] samlDecode(String s) {\n\t\treturn Base64.getMimeDecoder().decode(s);\n\t}\n\n\tstatic byte[] samlDeflate(String s) {\n\t\ttry {\n\t\t\tByteArrayOutputStream b = new ByteArrayOutputStream();\n\t\t\tDeflaterOutputStream deflater = new DeflaterOutputStream(b, new Deflater(Deflater.DEFLATED, true));\n\t\t\tdeflater.write(s.getBytes(StandardCharsets.UTF_8));\n\t\t\tdeflater.finish();\n\t\t\treturn b.toByteArray();\n\t\t}\n\t\tcatch (IOException ex) {\n\t\t\tthrow new Saml2Exception(\"Unable to deflate string\", ex);\n\t\t}\n\t}\n\n\tstatic String samlInflate(byte[] b) {\n\t\ttry {\n\t\t\tByteArrayOutputStream out = new ByteArrayOutputStream();\n\t\t\tInflaterOutputStream iout = new InflaterOutputStream(new CappedOutputStream(out), new Inflater(true));\n\t\t\tiout.write(b);\n\t\t\tiout.finish();\n\t\t\treturn new String(out.toByteArray(), StandardCharsets.UTF_8);\n\t\t}\n\t\tcatch (IOException ex) {\n\t\t\tthrow new Saml2Exception(\"Unable to inflate string\", ex);\n\t\t}\n\t}\n\n\tstatic EncodingConfigurer withDecoded(String decoded) {\n\t\treturn new EncodingConfigurer(decoded);","sourceCodeStart":43,"sourceCodeEnd":79,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/metadata/Saml2Utils.java#L43-L79","documentation":"Saml2Utils.samlDeflate compresses a SAML message string (typically a SAMLResponse/SAMLRequest) using raw DEFLATE as required for the SAML HTTP-Redirect binding. This Saml2Exception wraps any IOException raised while writing to or finishing the DeflaterOutputStream, e.g. failure allocating or writing the underlying ByteArrayOutputStream.","triggerScenarios":"Calling samlDeflate on a string when the Deflater/DeflaterOutputStream throws an IOException during write() or finish(); in practice this occurs during generation of a redirect-binding SAML URL when compression fails (rare; usually a JVM/resource-level problem).","commonSituations":"Generating a SAML AuthnRequest or Logout URL for the redirect binding; JVM under severe memory pressure so stream allocation fails; unusual JVM/zip provider issues.","solutions":["Retry the operation — this is almost always transient; if persistent, check JVM memory and restart","Verify you are on a supported, unmodified JDK (custom java.util.zip implementations can misbehave)","If you control the input, ensure the string is valid UTF-8-encodable text","Report to Spring Security if reproducible on a stock JVM"],"exampleFix":"try {\n    byte[] deflated = Saml2Utils.samlDeflate(xml);\n} catch (Saml2Exception ex) {\n    // inspect cause; typically transient JVM issue\n    logger.warn(\"Deflate failed, retrying\", ex.getCause());\n    deflated = Saml2Utils.samlDeflate(xml);\n}","handlingStrategy":"try-catch","validationCode":"if (s == null || s.isEmpty()) throw new Saml2Exception(\"Nothing to deflate\");","typeGuard":null,"tryCatchPattern":"try {\n    byte[] b = Saml2Utils.samlDeflate(xml);\n} catch (Saml2Exception ex) {\n    logger.error(\"deflate failed: {}\", ex.getCause(), ex);\n    throw ex;\n}","preventionTips":["Retry once — deflate failures are almost always transient JVM issues","Monitor JVM memory health; deflate failures often accompany memory pressure","Keep to stock JDKs to avoid broken java.util.zip providers"],"tags":["saml","compression","deflate","io"],"backgroundTag":"saml-deflate-failed","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}