spring-projects/spring-security · error · Saml2Exception

Unable to deflate string

Error message

Unable to deflate string

What it means

Saml2Utils.samlDeflate compresses a SAML message string using raw DEFLATE (no zlib/gzip header) for HTTP-Redirect binding. This Saml2Exception is thrown when an IOException occurs during the deflate write/finish, which is practically a JVM-internal I/O failure since the output is an in-memory ByteArrayOutputStream.

Source

Thrown at saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/authentication/Saml2Utils.java:61

	static String samlEncode(byte[] b) {
		return Base64.getEncoder().encodeToString(b);
	}

	static byte[] samlDecode(String s) {
		return Base64.getMimeDecoder().decode(s);
	}

	static byte[] samlDeflate(String s) {
		try {
			ByteArrayOutputStream b = new ByteArrayOutputStream();
			DeflaterOutputStream deflater = new DeflaterOutputStream(b, new Deflater(Deflater.DEFLATED, true));
			deflater.write(s.getBytes(StandardCharsets.UTF_8));
			deflater.finish();
			return b.toByteArray();
		}
		catch (IOException ex) {
			throw new Saml2Exception("Unable to deflate string", ex);
		}
	}

	static String samlInflate(byte[] b) {
		try {
			ByteArrayOutputStream out = new ByteArrayOutputStream();
			InflaterOutputStream iout = new InflaterOutputStream(new CappedOutputStream(out), new Inflater(true));
			iout.write(b);
			iout.finish();
			return new String(out.toByteArray(), StandardCharsets.UTF_8);
		}
		catch (IOException ex) {
			throw new Saml2Exception("Unable to inflate string", ex);
		}
	}

	static EncodingConfigurer withDecoded(String decoded) {
		return new EncodingConfigurer(decoded);

View on GitHub (pinned to 96852e8860)

Solutions

  1. Retry the operation — this is almost always transient/environmental
  2. Increase JVM heap if deflating very large SAML messages
  3. Check the wrapped cause (ex) for the real underlying failure and fix that
  4. Verify the JVM version for known java.util.zip defects and upgrade
Defensive patterns

Strategy: try-catch

Validate before calling

if (samlXml == null || samlXml.isEmpty()) {
    throw new IllegalArgumentException("empty SAML message, skip deflate");
}

Try / catch

try {
    byte[] deflated = Saml2Utils.samlDeflate(xml);
} catch (Saml2Exception e) {
    // inspect cause; treat as transient JVM/resource issue, retry or fail request
}

Prevention

When it happens

Trigger: samlDeflate(String s) creates a DeflaterOutputStream over a ByteArrayOutputStream and calls write/finish; the catch (IOException ex) branch throws "Unable to deflate string" — essentially only on memory exhaustion or unexpected Deflater failure.

Common situations: Very large SAML messages causing OutOfMemoryError surfacing as IOException during redirect-binding encoding; JVM resource exhaustion in constrained environments.

Related errors

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/1724b4d6b5ca5a7c. Report an issue: GitHub.