spring-projects/spring-security · warning · IOException

SAML payload exceeded maximum size of

Error message

SAML payload exceeded maximum size of 

What it means

The logout-side CappedOutputStream size guard: the incoming SAML logout message, once decoded, exceeds the maximum allowed size, so an IOException('SAML payload exceeded maximum size of ' + MAX_SIZE) is thrown. This is a decompression-bomb / DoS protection, not an application bug.

Source

Thrown at saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/web/authentication/logout/Saml2Utils.java:212

	}

	static class CappedOutputStream extends OutputStream {

		private static final long MAX_SIZE = 1024 * 1024;

		private final OutputStream delegate;

		private int size;

		CappedOutputStream(OutputStream delegate) {
			this.delegate = delegate;
		}

		@Override
		public void write(int b) throws IOException {
			if (this.size >= MAX_SIZE) {
				throw new IOException("SAML payload exceeded maximum size of " + MAX_SIZE);
			}
			this.delegate.write(b);
			this.size++;
		}

	}

}

View on GitHub (pinned to 96852e8860)

Solutions

1. Treat as an attack signal: reject, log, and rate-limit the SLO endpoint
2. If a legitimate IDP really needs larger logout messages, reduce message size at the IDP (trim attributes/extensions) or upgrade Spring Security if the cap was raised
3. Verify no client code calls the decode utility directly with untrusted unbounded input

if (sloParam != null && sloParam.length() > 100_000) {
    response.sendError(HttpServletResponse.SC_BAD_REQUEST);
    return;
}

try { /* logout processing */ } catch (IOException ex) {
    log.warn("SAML logout payload size limit exceeded", ex);
    response.sendError(HttpServletResponse.SC_BAD_REQUEST);
}

When it happens

Trigger: A SAMLLogoutRequest/SAMLLogoutResponse parameter whose decoded size exceeds MAX_SIZE is fed to the logout Saml2Utils decode path — oversized attack payloads or abnormally large logout messages.

Common situations: Malicious requests to the SingleLogout endpoint; fuzz testing; an IDP embedding huge NameID/extension data in logout messages.

Understand the failure class

Background: payload too large / request exceeds maximum size: why libraries cap bytes and how to fix oversize payloads — this error's family across 50 libraries.

Related errors

• SAML payload exceeded maximum size of
• SAML payload exceeded maximum size of
• Failed to decode SAMLResponse
• relying_party_registration_not_found
• invalid_destination

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/3232decc3a6538df. Report an issue: GitHub.