You are confusing an issue with the SP in C++ with a Java library of the same name used in OpenSAML-J 2.x, which is itself EOL, dead, insecure, etc, it has been for probably over a decade. -- Scott