[Saml-admins] Re: Shibboleth Identity Provider Security Advisory [13 May 2026]

-----Original Message----- From: announce &lt;announce-bounces(a)shibboleth.net&gt; On Behalf Of Scott Cantor via announce Sent: Wednesday, May 13, 2026 10:08 PM To: announce(a)shibboleth.net Cc: Scott Cantor &lt;scott(a)restingparrotsoftware.com&gt; Subject: Shibboleth Identity Provider Security Advisory [13 May 2026] Shibboleth Identity Provider Security Advisory [13 May 2026] An updated version of the Identity Provider software is available which includes explicit features and updated defaults to correct a denial of service vulnerability that can cause unconstrained resource consumption using XML that exceeds typical limits on certain kinds of content. Updates to OpenSAML are included in this patch, but this advisory refers to the specific impact and mitigations for the IdP itself. A separate advisory is available for OpenSAML alone. Maliciously crafted XML causes excessive resource consumption ============================================================= While the XML parser in newer versions of Java includes default settings that limit certain kinds of malicious content, older versions did not and so can be vulnerable to specially crafted XML. These default settings are in any case not set low enough to be safe in this usage context. The OpenSAML library's decoding of SAML and SOAP messages is unprotected in its default configuration from such content and parsing some messages can result in memory and/or CPU exhaustion, causing a denial of service in applications using it, including the Shibboleth Identity Provider. Since most XML message types are parsed either without the protection of a signature or in advance of evaluating one, the exploit does not require an authenticated attacker and so is serious, though as a denial of service issue it remains in a lower tier of vulnerabilities. An updated version of the IdP (V5.2.2) is available which add new properties that limit parsing of most content that could expose the system to attack: * idp.xml.elementAttributeLimit (default 30) * idp.xml.maxElementDepth (default 25) In addition, the IdP now uses distinct parser settings when parsing SAML Metadata that are less strict than those used in general or messaging scenarios (and can be independently controlled). This allows for unusually crafted Metadata that has been observed in the wild by our community. Finally, the IdP has been enhanced with several new properties that can be set to control the size limits on various types of SAML and SOAP messages being decoded. Those limits are not enabled by default, but are supported in case they are needed in the future. See also the Releases Notes [1] and documentation [2]. Recommendations =============== Update to V5.2.2 (or later) of the Identity Provider software. The updated default settings are deemed sufficiently safe at this time. In the event that upgrading is not possible, in most older versions one may directly configure new parser attributes directly by overriding the Spring bean used to control the parsing performed in most (but not all) cases. To do so, define a bean like so in conf/global.xml: <bean id="custom.ParserPool" parent="shibboleth.DefaultParserPool"> <property name="builderAttributes"> <map> <entry key="jdk.xml.elementAttributeLimit" value="30" /> <entry key="jdk.xml.maxElementDepth" value="25" /> </map> </property> </bean> Then add a property to conf/idp.properties: idp.xml.parserPool = custom.ParserPool This is not a foolproof solution for various reasons, but it mitigates the most common attack vectors. Note that we do not know the specific older versions of Java that support these parser attributes, and they are known to have gone by different names in some older versions prior to Java 17. If you are on an unsupported, older version, refer to the relevant JAXP parser documentation in that Java version for details. Credits ======= Jens Friess and Haya Schulmann, Goethe University Frankfurt. [1] https://shibboleth.atlassian.net/wiki/x/T4C0vg [2] https://shibboleth.atlassian.net/wiki/x/AQDJPQE URL for this Security Advisory: https://shibboleth.net/community/advisories/secadv_20260513.txt