CVE-2009-3476: Buffer overflow in OpenSAML before 1.1.3 as used in Internet2 Shibboleth Service Provider software 1.3.x be...

Security readout for executives and security teams

This is a legacy SAML infrastructure flaw affecting older OpenSAML, XMLTooling, and Internet2 Shibboleth Service Provider versions. A remote attacker could send a malformed encoded URL that crashes the service and may allow code execution. The bundle does not show active exploitation. Exposure is most likely where legacy Shibboleth Service Provider deployments or bundled OpenSAML/XMLTooling libraries still front SAML authentication flows, especially on internet-reachable federation endpoints. Modern deployments are not shown affected by the supplied bundle. Prioritize if any legacy Shibboleth SP, OpenSAML, or XMLTooling components remain in production identity infrastructure. The business concern is authentication outage and possible server compromise, but current exploitation evidence is not provided. Mitigation focus: Upgrade OpenSAML to 1.1.3 or later where applicable.; Upgrade XMLTooling to 1.2.2 or later where applicable.; Upgrade Shibboleth SP 1.3.x to 1.3.4 or later..

Prepared

Jun 28, 2026, 18:15 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.