The vulnerability arises in applications that use the spring-security-saml2-service-provider component with the REDIRECT binding for SAML 2.0 Login or Logout. A crafted compressed SAML payload can be inflated into memory without bounds, exhausting server resources and causing the application to become unresponsive. This is a classic denial of service flaw classified as CWE-400 and does not provide the attacker with direct data exfiltration or code execution capabilities.

Products affected are Spring Security versions 5.7.0 through 5.7.23, 5.8.0 through 5.8.25, 6.3.0 through 6.3.16, 6.4.0 through 6.4.16, 6.5.0 through 6.5.10, and 7.0.0 through 7.0.5. Only the spring-security-saml2-service-provider module within the Spring Framework is affected; no other vendors or products are listed.

The CVSS score of 7.5 indicates a high severity, while the EPSS score is not available and KEV has not listed this vulnerability. The likely attack vector is remote, via an attacker-specified SAML assertion transmitted over HTTP to the application’s SAML endpoint. An attacker can trigger the inflation by sending a specially compressed payload, leading to excessive memory consumption and service disruption. The lack of an EPSS rating does not diminish the risk, as memory exhaustion attacks can be simple to construct and do not require special privileges.