What causes "Unable to deflate string" in spring-projects/spring-security?

Retry the operation — this is almost always transient; if persistent, check JVM memory and restart

spring-projects/spring-security · error · Saml2Exception

Unable to deflate string

Error message

Unable to deflate string

What it means

Saml2Utils.samlDeflate compresses a SAML message string (typically a SAMLResponse/SAMLRequest) using raw DEFLATE as required for the SAML HTTP-Redirect binding. This Saml2Exception wraps any IOException raised while writing to or finishing the DeflaterOutputStream, e.g. failure allocating or writing the underlying ByteArrayOutputStream.

Source

Thrown at saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/metadata/Saml2Utils.java:61

	static String samlEncode(byte[] b) {
		return Base64.getEncoder().encodeToString(b);
	}

	static byte[] samlDecode(String s) {
		return Base64.getMimeDecoder().decode(s);
	}

	static byte[] samlDeflate(String s) {
		try {
			ByteArrayOutputStream b = new ByteArrayOutputStream();
			DeflaterOutputStream deflater = new DeflaterOutputStream(b, new Deflater(Deflater.DEFLATED, true));
			deflater.write(s.getBytes(StandardCharsets.UTF_8));
			deflater.finish();
			return b.toByteArray();
		}
		catch (IOException ex) {
			throw new Saml2Exception("Unable to deflate string", ex);
		}
	}

	static String samlInflate(byte[] b) {
		try {
			ByteArrayOutputStream out = new ByteArrayOutputStream();
			InflaterOutputStream iout = new InflaterOutputStream(new CappedOutputStream(out), new Inflater(true));
			iout.write(b);
			iout.finish();
			return new String(out.toByteArray(), StandardCharsets.UTF_8);
		}
		catch (IOException ex) {
			throw new Saml2Exception("Unable to inflate string", ex);
		}
	}

	static EncodingConfigurer withDecoded(String decoded) {
		return new EncodingConfigurer(decoded);

View on GitHub (pinned to 96852e8860)

Solutions

Retry the operation — this is almost always transient; if persistent, check JVM memory and restart
Verify you are on a supported, unmodified JDK (custom java.util.zip implementations can misbehave)
If you control the input, ensure the string is valid UTF-8-encodable text
Report to Spring Security if reproducible on a stock JVM

Example fix

try {
    byte[] deflated = Saml2Utils.samlDeflate(xml);
} catch (Saml2Exception ex) {
    // inspect cause; typically transient JVM issue
    logger.warn("Deflate failed, retrying", ex.getCause());
    deflated = Saml2Utils.samlDeflate(xml);
}

Defensive patterns

Strategy: try-catch

Validate before calling

if (s == null || s.isEmpty()) throw new Saml2Exception("Nothing to deflate");

Try / catch

try {
    byte[] b = Saml2Utils.samlDeflate(xml);
} catch (Saml2Exception ex) {
    logger.error("deflate failed: {}", ex.getCause(), ex);
    throw ex;
}

Prevention

Retry once — deflate failures are almost always transient JVM issues
Monitor JVM memory health; deflate failures often accompany memory pressure
Keep to stock JDKs to avoid broken java.util.zip providers

When it happens

Trigger: Calling samlDeflate on a string when the Deflater/DeflaterOutputStream throws an IOException during write() or finish(); in practice this occurs during generation of a redirect-binding SAML URL when compression fails (rare; usually a JVM/resource-level problem).

Common situations: Generating a SAML AuthnRequest or Logout URL for the redirect binding; JVM under severe memory pressure so stream allocation fails; unusual JVM/zip provider issues.

Related errors

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/d6e8d78d885b160d. Report an issue: GitHub.