Bug ID 2459541: APMD rejects valid SAMLResponse POST values containing URL-encoded CRLF line folding, breaking SAML SP ACS flow

Last Modified: Oct 16, 2026

Affected Product(s):
BIG-IP APM(all modules)

Fixed In:
21.1.0.3, 17.5.1.10, 17.1.3.6

Opened: Aug 14, 2026

Severity: 3-Major

Symptoms

APM as SP fails during ACS processing for otherwise valid SAML responses from the IdP /var/log/apm shows the following errors: HTTPParser.cpp func: "parsePostParam()" ... POST param 'SAMLResponse' value contains CRLF, rejecting request

Impact

Access policy execution fails, thereby rejecting sessions

Conditions

- Access policy has SAML auth configured - SAMLResponse or RelayState contains CRLF characters

Workaround

None

Fix Information

None

Behavior Change

Guides & references

K10134038: F5 Bug Tracker Filter Names and Tips