CVE-2026-93471
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2026
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
Unbounded SAML message decompression in esaml allows memory exhaustion
Improper Handling of Highly Compressed Data (Data Amplification) in esaml_binding in dropbox esaml allows an unauthenticated attacker to exhaust server memory and crash the Erlang VM via a crafted compressed SAMLResponse. esaml_binding:decode_response/2 base64-decodes the attacker-supplied SAMLResponse, inflates it with zlib:unzip/1 with no bound on the output, then converts the result to a charlist with binary_to_list/1 before parsing. This runs on the SAML consume (ACS) and single-logout endpoints, which accept unauthenticated requests by design, and it runs before any signature check. A small deflate stream reaches a compression ratio near 1000 to 1, so a request body of tens of kilobytes inflates to hundreds of megabytes and then to several gigabytes of list heap, so a few requests exhaust memory and take the node down. This issue affects esaml: from 0.1.0 onward.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
esaml
- Vendor
- handnot2
- Product
- esaml
- Platforms
- Unknown
- Default status
unaffected- Package
- handnot2/esaml
- Package collection
- https://github.com
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| deeb84378d5c82153b470e99d24f77c38afca14a | affected | git | * | Unavailable | None listed |
esaml
- Vendor
- arekinath
- Product
- esaml
- Platforms
- Unknown
- Default status
unaffected- Package
- arekinath/esaml
- Package collection
- https://github.com
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| deeb84378d5c82153b470e99d24f77c38afca14a | affected | git | * | Unavailable | None listed |
esaml
- Vendor
- dropbox
- Product
- esaml
- Platforms
- Unknown
- Default status
unaffected- Package
- esaml
- Package collection
- https://repo.hex.pm
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 0.1.0 | affected | semver | * | Unavailable | None listed |
esaml
- Vendor
- dropbox
- Product
- esaml
- Platforms
- Unknown
- Default status
unaffected- Package
- dropbox/esaml
- Package collection
- https://github.com
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| deeb84378d5c82153b470e99d24f77c38afca14a | affected | git | * | Unavailable | None listed |