spring-projects/spring-security · error · Saml2Exception

Unable to deflate string

Error message

Unable to deflate string

What it means

Saml2Utils.samlDeflate wraps any IOException thrown while RAW-DEFLATE compressing a SAML message string into a Saml2Exception with this message. Deflate is applied before Base64 encoding when producing a SAMLResponse/SAMLRequest for HTTP-Redirect bindings. Because the output is a ByteArrayOutputStream, failure is extremely rare (out-of-memory or a defect in the Deflater); it almost always indicates a JVM/platform-level problem rather than bad input.

Source

Thrown at saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/registration/Saml2Utils.java:61

	static String samlEncode(byte[] b) {
		return Base64.getEncoder().encodeToString(b);
	}

	static byte[] samlDecode(String s) {
		return Base64.getMimeDecoder().decode(s);
	}

	static byte[] samlDeflate(String s) {
		try {
			ByteArrayOutputStream b = new ByteArrayOutputStream();
			DeflaterOutputStream deflater = new DeflaterOutputStream(b, new Deflater(Deflater.DEFLATED, true));
			deflater.write(s.getBytes(StandardCharsets.UTF_8));
			deflater.finish();
			return b.toByteArray();
		}
		catch (IOException ex) {
			throw new Saml2Exception("Unable to deflate string", ex);
		}
	}

	static String samlInflate(byte[] b) {
		try {
			ByteArrayOutputStream out = new ByteArrayOutputStream();
			InflaterOutputStream iout = new InflaterOutputStream(new CappedOutputStream(out), new Inflater(true));
			iout.write(b);
			iout.finish();
			return new String(out.toByteArray(), StandardCharsets.UTF_8);
		}
		catch (IOException ex) {
			throw new Saml2Exception("Unable to inflate string", ex);
		}
	}

	static EncodingConfigurer withDecoded(String decoded) {
		return new EncodingConfigurer(decoded);

View on GitHub (pinned to 96852e8860)

Solutions

  1. Retain the causing exception (ex) and check whether it is an OutOfMemoryError wrapped or resource exhaustion; free memory / increase heap
  2. Retry the encode operation; deflate failures here are transient at worst
  3. Verify the JVM's java.util.zip implementation is intact (don't replace zip providers); test deflate on a simple string
  4. If it persists, file a bug with the full stack trace including the cause

Example fix

// before
String encoded = Saml2Utils.withDecoded(xml).deflate(true).encode();
// after
try {
    String encoded = Saml2Utils.withDecoded(xml).deflate(true).encode();
} catch (Saml2Exception ex) {
    logger.warn("deflate failed", ex.getCause()); // inspect cause (usually memory)
}
Defensive patterns

Strategy: try-catch

Validate before calling

if (xml == null || xml.isEmpty()) { throw new IllegalArgumentException("cannot deflate empty SAML message"); }

Type guard

boolean isDeflatable(String xml) { return xml != null && !xml.isEmpty() && xml.length() < 16 * 1024 * 1024; }

Try / catch

try { encoded = Saml2Utils.withDecoded(xml).deflate(true).encode(); } catch (Saml2Exception ex) { throw new IllegalStateException("SAML deflate failed (check memory/JVM zip provider)", ex); }

Prevention

When it happens

Trigger: Calling EncodingConfigurer.deflate(true).encode() (or Saml2Utils.samlDeflate directly) when the DeflaterOutputStream.write or finish() call raises IOException — practically only under JVM memory exhaustion or a corrupted zlib/Deflater implementation.

Common situations: Encoding an outbound SAML authentication request for a Redirect binding on a JVM under severe memory pressure; running on a JVM with a broken/patched java.util.zip provider; OOM conditions during large message compression.

Understand the failure class

Background: "This is a bug, please report it": internal invariant violations, unreachable panics, and SNH errors explained — this error's family across 47 libraries.

Related errors

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/bd1a9c2b0d956e36. Report an issue: GitHub.