← Back

CVE-2026-40988

nvd nist
Published: Jun 10, 2026Modified: Jun 12, 2026

JSON object

Loading...
7.5
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Exploitability: 3.9 / Impact: 3.6
Source: security@vmware.com (Secondary)

Description

An application using spring-security-saml2-service-provider and the REDIRECT binding for SAML 2.0 Login or Logout may be vulnerable to a denial of service by way of an unbounded writer that inflates the compressed SAML payload into memory. Affected versions: Spring Security 5.7.0 through 5.7.23; 5.8.0 through 5.8.25; 6.3.0 through 6.3.16; 6.4.0 through 6.4.16; 6.5.0 through 6.5.10; 7.0.0 through 7.0.5.

Affected (6)

Vmware
1 product
Spring Security
Configuration A
6 vulnerable
Vulnerable SoftwareAffected Versions
Vmware
Spring Security
From 5.7.0 to 5.7.24
Spring Security
From 5.8.0 to 5.8.26
Spring Security
From 6.3.0 to 6.3.17
Spring Security
From 6.4.0 to 6.4.17
Spring Security
From 6.5.0 to 6.5.11
Spring Security
From 7.0.0 to 7.0.6

Related CWEs

CWE-400
Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

References (1)

Source: security@vmware.com
Vendor Advisory

Timeline

No history available yet.