Denial of Service Vulnerability in Armeria-SAML by Line Corporation
CVE-2026-121820

8.7HIGH

Key Information:

Vendor

Ly Corporation

Status
Armeria
Vendor
CVE Published:
6 November 2026

What is CVE-2026-121820?

A vulnerability exists in Armeria-SAML versions before 1.43.0 that allows attackers to exploit the HTTP-Redirect binding decoder. This issue arises when the decoder decompresses SAML messages submitted by attackers without adequate limitations on output size during signature validation. As a result, an unauthenticated remote attacker could exhaust server memory, potentially leading to denial of service and interruptions in service availability.

Affected Version(s)

Armeria 1.43.0

References

https://line.github.io/security-advisory-blog/CVE-2026-12...
https://github.com/line/armeria/security/advisories/GHSA-...

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.