[EXTERN] Shibboleth Identity Provider Security Advisory [13 May 2026]

[Scott Cantor]

> On May 13, 2026, at 7:42 PM, Bernd Oberknapp <bo at ub.uni-freiburg.de> wrote:
> 
> With an jdk.xml.elementAttributeLimit of 30 our IdP fails to load the eduGAIN metadata, which has about 60 attributes in the EntitiesDescriptor element.

1. That mnetadata is not formed sensibly.

2. Nobody should be consuming that metadata, let alone any aggregate in 2026.

3. Regardless of 1 and 2, we know that metadata is borked, and that's precisely why we didn't default things that way and split off the metadata parsing bean so it would ue a different default, and set up separate properties to control it independently.

-- Scott