spring-projects/spring-security · error · Saml2Exception

Unable to inflate string

Error message

Unable to inflate string

What it means

Logout-package Saml2Utils.samlInflate decompresses a DEFLATE-encoded SAML logout message from HTTP-Redirect binding. Saml2Exception "Unable to inflate string" is thrown when decompression fails: input is not raw-DEFLATE, is corrupt/truncated, or exceeds the CappedOutputStream limit.

Source

Thrown at saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/authentication/logout/Saml2Utils.java:74

			deflater.write(s.getBytes(StandardCharsets.UTF_8));
			deflater.finish();
			return b.toByteArray();
		}
		catch (IOException ex) {
			throw new Saml2Exception("Unable to deflate string", ex);
		}
	}

	static String samlInflate(byte[] b) {
		try {
			ByteArrayOutputStream out = new ByteArrayOutputStream();
			InflaterOutputStream iout = new InflaterOutputStream(new CappedOutputStream(out), new Inflater(true));
			iout.write(b);
			iout.finish();
			return new String(out.toByteArray(), StandardCharsets.UTF_8);
		}
		catch (IOException ex) {
			throw new Saml2Exception("Unable to inflate string", ex);
		}
	}

	static EncodingConfigurer withDecoded(String decoded) {
		return new EncodingConfigurer(decoded);
	}

	static DecodingConfigurer withEncoded(String encoded) {
		return new DecodingConfigurer(encoded);
	}

	static final class EncodingConfigurer {

		private final String decoded;

		private boolean deflate;

		private EncodingConfigurer(String decoded) {

View on GitHub (pinned to 96852e8860)

Solutions

  1. Verify single, correct Base64 decoding of the SAMLRequest/SAMLResponse/SAMLLogout parameter before inflation
  2. Confirm the IdP compresses with raw DEFLATE per redirect-binding spec
  3. Use HTTP-POST binding for large logout messages that hit the size cap
  4. Log the wrapped cause to distinguish corruption from decompression-bomb attempts

Example fix

// before
 byte[] raw = Base64.getDecoder().decode(Base64.getDecoder().decode(param)); // double decode
// after
 byte[] raw = Base64.getDecoder().decode(param);
Defensive patterns

Strategy: try-catch

Validate before calling

byte[] raw;
try { raw = Base64.getDecoder().decode(b64Param); }
catch (IllegalArgumentException e) { return null; }
if (raw.length > MAX_EXPECTED_COMPRESSED) return null;

Try / catch

try {
    String xml = Saml2Utils.samlInflate(raw);
} catch (Saml2Exception e) {
    // corrupt logout message or size cap exceeded; reject and log
}

Prevention

When it happens

Trigger: logout Saml2Utils.samlInflate(byte[] b) writes to InflaterOutputStream over CappedOutputStream; corrupt/non-raw-deflate bytes or oversized payload trigger IOException and the exception.

Common situations: Logout request/response parameter corrupted in transit, wrong Base64 decoding before inflation, IdP emitting zlib-wrapped data, or a malicious oversized SLO payload hitting the cap.

Related errors

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/1e1a62f10a5720d5. Report an issue: GitHub.