{"id":"CVE-2026-121820","kind":"vulnerability","aliases":["CVE-2026-121820"],"related":[],"title":"armeria-saml: unbounded decompression lets remote attackers exhaust server memory","description":"A vulnerability has been identified in armeria-saml versions prior to 1.43.0, where the HTTP-Redirect binding decoder decompresses attacker-supplied SAML messages without limiting the output size before signature validation, allowing an unauthenticated remote attacker to exhaust server memory and cause a denial of service.","summary":"armeria-saml's HTTP-Redirect binding decompresses incoming SAML messages without an output size limit before checking the signature. An unauthenticated attacker can send a small compressed payload that expands to exhaust server memory and crash the service.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["armeria-saml","java","package","saml","sso"],"not_affected_if":["http-post-binding-only","no-saml-sso"],"how_to_check":"- Check the armeria-saml version in the project's dependency file (for example `armeria-saml` in build.gradle or pom.xml) and see whether it is below `1.43.0`\n- Check whether the application accepts SAML HTTP-Redirect binding requests","fix":"- armeria-saml: upgrade to `1.43.0` or later","status":"open","published_at":"2026-11-06T08:17:20+00:00","first_seen_at":"2026-11-06T08:40:33+00:00","triaged_at":"2026-11-06T08:42:30+00:00","updated_at":"2026-11-06T08:42:30+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-06T08:42:30Z","model":"claude-haiku-5-5","output":{"fix":"- armeria-saml: upgrade to `1.43.0` or later","reach":"internet","title":"armeria-saml: unbounded decompression lets remote attackers exhaust server memory","impact":"medium","summary":"armeria-saml's HTTP-Redirect binding decompresses incoming SAML messages without an output size limit before checking the signature. An unauthenticated attacker can send a small compressed payload that expands to exhaust server memory and crash the service.","audience":"developers","category":"package","nicknames":[],"who_cares":["armeria-saml","java","saml","sso"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Remote attacker crashes the service by exhausting server memory","analyst_note":"","how_to_check":"- Check the armeria-saml version in the project's dependency file (for example `armeria-saml` in build.gradle or pom.xml) and see whether it is below `1.43.0`\n- Check whether the application accepts SAML HTTP-Redirect binding requests","plain_action":"","needs_analyst":false,"not_affected_if":["no-saml-sso","http-post-binding-only"],"who_is_affected":"Applications that use armeria-saml to handle SAML single sign-on through the HTTP-Redirect binding are exposed, and the flaw is reachable without logging in. Services that do not use armeria-saml, or that do not accept SAML HTTP-Redirect requests, can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000693,"input_tokens":4251,"output_tokens":536,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-121820':14A,17A '-2026':13A,16A '1.43.0':77C 'allow':99C 'armeria':2A,19B,26B,72C 'armeria-saml':1A,18B,25B,71C 'attack':8A,48B,87C,103C 'attacker-suppli':86C 'bind':32B,83C 'caus':109C 'check':43B 'compress':53B 'crash':62B 'cve':12A,15A 'decod':84C 'decompress':5A,33B,85C 'denial':111C 'exhaust':9A,58B,105C 'expand':56B 'http':30B,81C 'http-redirect':29B,80C 'identifi':69C 'incom':34B 'java':21B 'let':6A 'limit':41B,92C 'memori':11A,60B,107C 'messag':36B,90C 'output':39B,94C 'packag':22B 'payload':54B 'prior':75C 'redirect':31B,82C 'remot':7A,102C 'saml':3A,20B,23B,27B,35B,73C,89C 'send':50B 'server':10A,59B,106C 'servic':64B,113C 'signatur':45B,97C 'size':40B,95C 'small':52B 'sso':24B 'suppli':88C 'unauthent':47B,101C 'unbound':4A 'valid':98C 'version':74C 'vulner':66C 'without':37B,91C","nicknames":[],"mitigations":[],"who_affected":"Applications that use armeria-saml to handle SAML single sign-on through the HTTP-Redirect binding are exposed, and the flaw is reachable without logging in. Services that do not use armeria-saml, or that do not accept SAML HTTP-Redirect requests, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["armeriasaml","high","java","package","saml","sso"],"campaign_type":null,"search_a":"'-121820':14A,17A '-2026':13A,16A 'armeria':2A 'armeria-saml':1A 'attack':8A 'cve':12A,15A 'decompress':5A 'exhaust':9A 'let':6A 'memori':11A 'remot':7A 'saml':3A 'server':10A 'unbound':4A","search_b":"'armeria':19B,26B 'armeria-saml':18B,25B 'attack':48B 'bind':32B 'check':43B 'compress':53B 'crash':62B 'decompress':33B 'exhaust':58B 'expand':56B 'http':30B 'http-redirect':29B 'incom':34B 'java':21B 'limit':41B 'memori':60B 'messag':36B 'output':39B 'packag':22B 'payload':54B 'redirect':31B 'saml':20B,23B,27B,35B 'send':50B 'server':59B 'servic':64B 'signatur':45B 'size':40B 'small':52B 'sso':24B 'unauthent':47B 'without':37B","search_c":"'1.43.0':77C 'allow':99C 'armeria':72C 'armeria-saml':71C 'attack':87C,103C 'attacker-suppli':86C 'bind':83C 'caus':109C 'decod':84C 'decompress':85C 'denial':111C 'exhaust':105C 'http':81C 'http-redirect':80C 'identifi':69C 'limit':92C 'memori':107C 'messag':90C 'output':94C 'prior':75C 'redirect':82C 'remot':102C 'saml':73C,89C 'server':106C 'servic':113C 'signatur':97C 'size':95C 'suppli':88C 'unauthent':101C 'valid':98C 'version':74C 'vulner':66C 'without':91C","first_public_at":"2026-11-06T07:18:24+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"dl_cve@linecorp.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121820","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121820","severity":null,"published_at":"2026-11-06T08:17:20+00:00","modified_at":"2026-11-06T08:17:20+00:00","first_seen_at":"2026-11-06T08:40:33+00:00","fetched_at":"2026-11-06T08:40:33+00:00","note":null}],"documents":[{"id":84760,"url":"https://github.com/line/armeria/security/advisories/GHSA-6hgp-j5h7-33m3","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-06T07:18:24+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}