A vulnerability exists in armeria-saml prior to version 1.43.0 where the HTTP-Redirect binding decoder decompresses SAML messages supplied by an attacker without imposing an output size limit before validating the signature. This flaw allows an unauthenticated remote attacker to send oversized compressed messages that, when decompressed, consume a large amount of server memory, eventually exhausting resources and causing a denial of service. The CVSS score of 8.7 reflects the high impact of this memory exhaustion.

The affected product is LY Corporation’s Armeria library, specifically the armeria-saml component before the 1.43.0 release. Users running any earlier version of armeria-saml are potentially vulnerable.

The EPSS score is not available, but the high CVSS score indicates a serious risk. The vulnerability is not listed in the CISA KEV catalog, and no public exploits have been reported. The likely attack vector involves sending crafted HTTP-Redirect binding messages that trigger decompression. An attacker does not require authentication or additional privileges, making the threat straightforward for remote exploitation.