CVE-2026-121820: Security vulnerability

Published Nov 6, 2026

Updated

A vulnerability has been identified in armeria-saml versions prior to 1.43.0, where the HTTP-Redirect binding decoder decompresses attacker-supplied SAML messages without limiting the output size before signature validation, allowing an unauthenticated remote attacker to exhaust server memory and cause a denial of service.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade armeria-saml to a version that resolves this vulnerability.
Fixed in 1.43.0

Event History

Nov 6, 2026

CVE Published

via MITRE·07:46 AM

Data Sourced

via MITRE·07:46 AM

DescriptionWeakness

Frequently Asked Questions

Who is exposed to this denial-of-service issue?

Deployments using armeria-saml versions earlier than 1.43.0 that process SAML messages through the HTTP-Redirect binding decoder are exposed. An unauthenticated remote attacker can target the affected decoder.

What does an attacker need to do to exploit it?

The attacker needs to provide a crafted SAML message that expands to a large size when decompressed. The decompression occurs before signature validation, so a valid signature is not required.

Which version addresses the issue?

The issue affects versions prior to 1.43.0. Upgrading to 1.43.0 or later removes the affected version range described in the advisory.

CVE-2026-121820: Security vulnerability

Remediation

Event History

Frequently Asked Questions

Who is exposed to this denial-of-service issue?

What does an attacker need to do to exploit it?

Which version addresses the issue?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this denial-of-service issue?

What does an attacker need to do to exploit it?

Which version addresses the issue?