Improper Handling of Highly Compressed Data (Data Amplification) Affecting com.linecorp.armeria:armeria-saml package, versions [,1.43.0)

Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data (Data Amplification) via the fromDeflatedBase64 function in HttpRedirectBindingUtil. An unauthenticated attacker can send a small, highly compressible DEFLATE-encoded SAMLRequest or SAMLResponse in a form-encoded request body to an HTTP-Redirect endpoint; the function inflates it before signature validation, exhausting server heap and causing OutOfMemoryError and denial of service.

Notes

• Endpoint-reachability gate: SamlServiceProviderBuilder registers HTTP-Redirect endpoints by default when none are specified, so a stock provider exposes this path.
• Request-size limit: The attacker’s inflated output is bounded by maxRequestLength on the request body (10 MiB by default), though that still permits substantial expansion.

Workarounds

• Lower maxRequestLength on the SAML endpoints and/or configure a proxy or WAF to cap request-body size, limiting the size of requests that can trigger decompression.
• Disable the HTTP-Redirect binding and use HTTP-POST binding only if Redirect is not required, preventing this attack vector from reaching the affected inflater.

• GitHub Commit armeria-1.43.0
• line.github.io
• Maintainer's Advisory