CVE-2026-40988: spring spring security Uncontrolled Resource Consumption
Vulnerability summary
CVE-2026-40988 is a high (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in spring spring security. EPSS estimates a 0.46% chance of exploitation in the next 30 days, higher than 38.5% of scored vulnerabilities.
Timeline
- 09-06-2026PublishedVulnerability first disclosed.
- 27-06-2026Last modifiedVulnerability information updated.
Description
An application using spring-security-saml2-service-provider and the REDIRECT binding for SAML 2.0 Login or Logout may be vulnerable to a denial of service by way of an unbounded writer that inflates the compressed SAML payload into memory. Affected versions: Spring Security 5.7.0 through 5.7.23; 5.8.0 through 5.8.25; 6.3.0 through 6.3.16; 6.4.0 through 6.4.16; 6.5.0 through 6.5.10; 7.0.0 through 7.0.5.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · MavenEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.46%
Chance of exploitation in the next 30 days
Percentile
39%
Versus all other CVEs
30-day change
+0.13 pp
From 0.33% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Org.springframework.security1 product
- spring-security-saml2-service-provider≥ 7.0.0, < 7.0.6 | ≥ 6.5.0, < 6.5.11 | ≥ 6.4.0, ≤ 6.4.16 | ≥ 6.3.0, ≤ 6.3.16 | ≥ 5.8.0, ≤ 5.8.25 | ≤ 5.7.23
Spring1 product
- spring security≥ 5.7.0, < 5.7.24 | ≥ 5.8.0, < 5.8.26 | ≥ 6.3.0, < 6.3.17 | ≥ 6.4.0, < 6.4.17 | ≥ 6.5.0, < 6.5.10.2 | ≥ 7.0.0, < 7.0.5.1
Vmware1 product
- spring_security≥ 5.7.0, < 5.7.24 | ≥ 5.8.0, < 5.8.26 | ≥ 6.3.0, < 6.3.17 | ≥ 6.4.0, < 6.4.17 | ≥ 6.5.0, < 6.5.10.2 | ≥ 7.0.0, < 7.0.5.1
3 vendors · 3 products
