What causes "Unable to deflate string" in spring-projects/spring-security?

Inspect ex.getCause() for the real I/O failure; the input string content itself cannot cause this error.

spring-projects/spring-security · error · Saml2Exception

Unable to deflate string

Error message

Unable to deflate string

What it means

Saml2Utils.samlDeflate compresses a string using a raw (nowrap) DEFLATE stream, as required for SAML HTTP-Redirect binding; any IOException during compression is wrapped in this Saml2Exception. Because the underlying stream is an in-memory ByteArrayOutputStream, this is essentially a defensive wrapper for the checked IOException rather than an input-driven failure.

Source

Thrown at saml2/saml2-service-provider/src/opensaml5Main/java/org/springframework/security/saml2/provider/service/authentication/logout/Saml2Utils.java:63

	static String samlEncode(byte[] b) {
		return Base64.getEncoder().encodeToString(b);
	}

	static byte[] samlDecode(String s) {
		return Base64.getMimeDecoder().decode(s);
	}

	static byte[] samlDeflate(String s) {
		try {
			ByteArrayOutputStream b = new ByteArrayOutputStream();
			DeflaterOutputStream deflater = new DeflaterOutputStream(b, new Deflater(Deflater.DEFLATED, true));
			deflater.write(s.getBytes(StandardCharsets.UTF_8));
			deflater.finish();
			return b.toByteArray();
		}
		catch (IOException ex) {
			throw new Saml2Exception("Unable to deflate string", ex);
		}
	}

	static String samlInflate(byte[] b) {
		try {
			ByteArrayOutputStream out = new ByteArrayOutputStream();
			InflaterOutputStream iout = new InflaterOutputStream(out, new Inflater(true));
			iout.write(b);
			iout.finish();
			return new String(out.toByteArray(), StandardCharsets.UTF_8);
		}
		catch (IOException ex) {
			throw new Saml2Exception("Unable to inflate string", ex);
		}
	}

	static EncodingConfigurer withDecoded(String decoded) {
		return new EncodingConfigurer(decoded);

View on GitHub (pinned to 96852e8860)

Solutions

Inspect ex.getCause() for the real I/O failure; the input string content itself cannot cause this error.
Check JVM memory/resource pressure (heap dumps, nearby OutOfMemoryError) if it reproduces.
Retry the operation — only transient JVM-level failures are a realistic trigger.
If persistent, replace with an equivalent raw-DEFLATE utility or file a bug with a reproducer.

Example fix

// before
byte[] deflated = Saml2Utils.samlDeflate(hugeString); // memory pressure -> Saml2Exception: Unable to deflate string
// after
byte[] deflated = Saml2Utils.samlDeflate(normalSizedXml);

Defensive patterns

Strategy: try-catch

Try / catch

try {
    byte[] deflated = Saml2Utils.samlDeflate(xml);
} catch (Saml2Exception ex) {
    logger.error("Deflate failed (JVM-level I/O error)", ex.getCause());
    throw new IllegalStateException("SAML compression failed", ex);
}

Prevention

Remember this failure is JVM-level, not input-driven — investigate cause first.
Watch heap/memory pressure when compressing very large messages.
Retry once on transient failures.
Keep SAML messages small; avoid embedding huge attributes.

When it happens

Trigger: Calling Saml2Utils.samlDeflate(String) when DeflaterOutputStream.write/finish throws IOException — realistically only under JVM-level failures such as memory exhaustion during buffer growth, since the stream is in-memory and cannot fail on bad input.

Common situations: Redirect-binding request construction failing unexpectedly; the exception surfacing alongside OutOfMemoryError or other JVM resource problems; seeing it in tests after refactoring the stream implementation.

Related errors

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/1ddc1e9e12094676. Report an issue: GitHub.