CVE-2026-40988

Name of the Vulnerable Software and Affected Versions Spring Security versions 5.7.0 through 5.7.23 Spring Security versions 5.8.0 through 5.8.25 Spring Security versions 6.3.0 through 6.3.16 Spring Security versions 6.4.0 through 6.4.16 Spring Security versions 6.5.0 through 6.5.10 Spring Security versions 7.0.0 through 7.0.5

Description Applications utilizing spring-security-saml2-service-provider and the REDIRECT binding for SAML 2.0 Login or Logout are susceptible to a denial of service. This occurs due to an unbounded writer that inflates compressed SAML payloads into memory, potentially exhausting system resources.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.