spring-projects/spring-security · warning · IOException

SAML payload exceeded maximum size of

Error message

SAML payload exceeded maximum size of 

What it means

Thrown by the internal CappedOutputStream while base64-decoding an incoming SAMLResponse: the decoded payload exceeded the hard maximum size (MAX_SIZE, a decompression-bomb guard). The library deliberately aborts rather than buffering an unbounded payload. It is a security control, not a bug.

Source

Thrown at saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/web/authentication/Saml2Utils.java:212

	}

	static class CappedOutputStream extends OutputStream {

		private static final long MAX_SIZE = 1024 * 1024;

		private final OutputStream delegate;

		private int size;

		CappedOutputStream(OutputStream delegate) {
			this.delegate = delegate;
		}

		@Override
		public void write(int b) throws IOException {
			if (this.size >= MAX_SIZE) {
				throw new IOException("SAML payload exceeded maximum size of " + MAX_SIZE);
			}
			this.delegate.write(b);
			this.size++;
		}

	}

}

View on GitHub (pinned to 96852e8860)

Solutions

1. Confirm the payload is legitimate; a truly oversized SAMLResponse from a trusted IDP usually indicates a misconfiguration at the IDP (limit attribute sizes)
2. If a larger cap is genuinely required, upgrade Spring Security — the cap is internal; otherwise split/reduce assertion content at the IDP
3. Treat unexpected oversized payloads as attacks: reject, log source IP, and monitor the endpoint
4. Ensure clients cannot bypass the normal filter chain and feed Saml2Utils directly

if (samlResponseParam != null && samlResponseParam.length() > 100_000) {
    log.warn("Oversized SAMLResponse rejected before processing");
    response.sendError(HttpServletResponse.SC_BAD_REQUEST);
    return;
}

try { /* saml processing */ } catch (IOException ex) {
    log.warn("SAML payload size limit exceeded", ex);
    response.sendError(HttpServletResponse.SC_BAD_REQUEST);
}

When it happens

Trigger: A SAMLResponse form parameter whose decoded length exceeds Saml2Utils' MAX_SIZE cap is passed to Saml2Utils.decode, e.g. an attacker-supplied oversized payload or an unusually huge response (giant attributes, embedded base64 blobs) from a misbehaving IDP.

Common situations: Malicious/fuzzed requests hitting the SSO endpoint; an IDP configured with enormous attribute statements; test harness posting very large fake responses.

Understand the failure class

Background: payload too large / request exceeds maximum size: why libraries cap bytes and how to fix oversize payloads — this error's family across 50 libraries.

Related errors

• SAML payload exceeded maximum size of
• SAML payload exceeded maximum size of
• internal_validation_error
• malformed_response_data
• decryption_error

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/960087b52cc31569. Report an issue: GitHub.