What is the CVSS score of CVE-2026-40988?

CVE-2026-40988 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Spring Security are affected by CVE-2026-40988?

Spring Security's SAML 2.0 service provider module contains a denial-of-service vulnerability (CVE-2026-40988, CVSS 7.5) that allows remote unauthenticated attackers to exhaust application memory…. A patch is available.

How to fix or mitigate CVE-2026-40988?

Within 24 hours: Inventory all applications using Spring Security with SAML Login or Logout (search build artifacts for spring-security-saml2-service-provider dependency). Within 7 days: Deploy compensating controls-configure WAF or load balancer to limit SAML REDIRECT/POST binding payloads to 1-5 MB maximum, enable per-IP rate limiting on SAML endpoints (/saml2/service-provider-metadata, /login/saml2/sso), and deploy memory/CPU monitoring with threshold alerts for decompression resource spikes. Within 30 days: Establish daily vendor monitoring cadence (Spring Security GitHub releases, VMware Security Advisory) and prepare emergency patching runbook for immediate deployment upon patch availability.

Spring Security CVE-2026-40988

EUVD-2026-35883 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-06-10 security@vmware.com

GHSA-m69x-pw9p-7j3q

Denial Of Service Java Spring Security

7.5

CVSS 3.1 · Vendor: vmware

Severity by source

Vendor (vmware) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (vmware) · only source for this CVE.

CVSS VectorVendor: vmware

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Jun 10, 2026 - 02:01 EUVD

Analysis Generated

Jun 10, 2026 - 00:30 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

3 maven packages depend on org.springframework.security:spring-security-saml2-service-provider (1 direct, 2 indirect)

Ecosystem-wide dependent count for version 7.0.0.

DescriptionCVE.org

An application using spring-security-saml2-service-provider and the REDIRECT binding for SAML 2.0 Login or Logout may be vulnerable to a denial of service by way of an unbounded writer that inflates the compressed SAML payload into memory.

Affected versions: Spring Security 5.7.0 through 5.7.23; 5.8.0 through 5.8.25; 6.3.0 through 6.3.16; 6.4.0 through 6.4.16; 6.5.0 through 6.5.10; 7.0.0 through 7.0.5.

AnalysisAI

Denial of service in Spring Security's SAML 2.0 service provider module allows remote unauthenticated attackers to exhaust application memory by submitting a maliciously compressed SAML payload over the REDIRECT binding. The flaw stems from an unbounded inflater that decompresses attacker-controlled data without size limits, enabling a classic decompression-bomb attack against any Spring application using SAML Login or Logout. No public exploit identified at time of analysis, but the network-reachable, no-authentication CVSS profile (7.5 High) makes this a near-term patching priority for SAML-enabled deployments.

Technical ContextAI

Spring Security's spring-security-saml2-service-provider module implements SAML 2.0 SP functionality for Java applications, supporting both POST and REDIRECT bindings. Under the REDIRECT binding, SAML messages are DEFLATE-compressed and base64-encoded in URL query parameters per the SAML 2.0 specification. The vulnerable code path inflates this compressed payload into memory without bounding the decompressed size, which maps to CWE-400 (Uncontrolled Resource Consumption). A small compressed payload can expand to gigabytes (a 'zip bomb' / 'decompression bomb' pattern), exhausting JVM heap and triggering OutOfMemoryError or sustained GC pressure that renders the service unresponsive.

RemediationAI

Patch available per vendor advisory at https://spring.io/security/cve-2026-40988 - upgrade to the next patched maintenance release in each affected branch (5.7.24+, 5.8.26+, 6.3.17+, 6.4.17+, 6.5.11+, 7.0.6+ as released by VMware/Broadcom; verify exact fix version against the Spring advisory before deployment). If immediate upgrade is not feasible, switch SAML 2.0 Login and Logout flows to the POST binding instead of REDIRECT, which removes the vulnerable decompression code path at the cost of breaking IdP relationships configured for REDIRECT only and requiring IdP-side reconfiguration. As a network-layer compensating control, place a WAF or reverse proxy in front of the SAML endpoints (typically /login/saml2/sso/* and /logout/saml2/slo) and enforce a strict maximum length on the SAMLRequest and SAMLResponse query parameters - note this only limits compressed size, not the decompression ratio, so it reduces but does not eliminate risk.