Skip to content
Heist/ feed
High

Unbounded SAML message decompression in esaml allows memory exhaustion

Type: advisorySource: Official CVE List1 source record

Improper Handling of Highly Compressed Data (Data Amplification) in esaml_binding in dropbox esaml allows an unauthenticated attacker to exhaust server memory and crash the Erlang VM via a crafted compressed SAMLResponse. esaml_binding:decode_response/2 base64-decodes the attacker-supplied SAMLResponse, inflates it with zlib:unzip/1 with no bound on the output, then converts the result to a charlist with binary_to_list/1 before parsing. This runs on the SAML consume (ACS) and single-logout endpoints, which accept unauthenticated requests by design, and it runs before any signature check. A small deflate stream reaches a compression ratio near 1000 to 1, so a request body of tens of kilobytes inflates to hundreds of megabytes and then to several gigabytes of list heap, so a few requests exhaust memory and take the node down. This issue affects esaml: from 0.1.0 onward.

Announced Source revision 1
Original source ↗

CVE-2026-93471

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-93471

esaml

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

esaml

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

esaml

Source reference: /containers/cna/affected/2/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

esaml

Source reference: /containers/cna/affected/3/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "cpes": [
      "cpe:2.3:a:handnot2:esaml:*:*:*:*:*:*:*:*"
    ],
    "repo": "https://github.com/handnot2/esaml",
    "vendor": "handnot2",
    "modules": [
      "esaml_binding",
      "esaml_cowboy"
    ],
    "product": "esaml",
    "versions": [
      {
        "status": "affected",
        "version": "deeb84378d5c82153b470e99d24f77c38afca14a",
        "lessThan": "*",
        "versionType": "git"
      }
    ],
    "packageURL": "pkg:github/handnot2/esaml",
    "packageName": "handnot2/esaml",
    "programFiles": [
      "src/esaml_binding.erl",
      "src/esaml_cowboy.erl"
    ],
    "collectionURL": "https://github.com",
    "defaultStatus": "unaffected",
    "programRoutines": [
      {
        "name": "esaml_binding:decode_response/2"
      },
      {
        "name": "esaml_cowboy:validate_assertion/2"
      },
      {
        "name": "esaml_cowboy:validate_logout/2"
      }
    ]
  },
  {
    "cpes": [
      "cpe:2.3:a:arekinath:esaml:*:*:*:*:*:*:*:*"
    ],
    "repo": "https://github.com/arekinath/esaml",
    "vendor": "arekinath",
    "modules": [
      "esaml_binding",
      "esaml_cowboy"
    ],
    "product": "esaml",
    "versions": [
      {
        "status": "affected",
        "version": "deeb84378d5c82153b470e99d24f77c38afca14a",
        "lessThan": "*",
        "versionType": "git"
      }
    ],
    "packageURL": "pkg:github/arekinath/esaml",
    "packageName": "arekinath/esaml",
    "programFiles": [
      "src/esaml_binding.erl",
      "src/esaml_cowboy.erl"
    ],
    "collectionURL": "https://github.com",
    "defaultStatus": "unaffected",
    "programRoutines": [
      {
        "name": "esaml_binding:decode_response/2"
      },
      {
        "name": "esaml_cowboy:validate_assertion/2"
      },
      {
        "name": "esaml_cowboy:validate_logout/2"
      }
    ]
  },
  {
    "cpes": [
      "cpe:2.3:a:dropbox:esaml:*:*:*:*:*:*:*:*"
    ],
    "repo": "https://github.com/dropbox/esaml",
    "vendor": "dropbox",
    "modules": [
      "esaml_binding",
      "esaml_cowboy"
    ],
    "product": "esaml",
    "versions": [
      {
        "status": "affected",
        "version": "0.1.0",
        "lessThan": "*",
        "versionType": "semver"
      }
    ],
    "packageURL": "pkg:hex/esaml",
    "packageName": "esaml",
    "programFiles": [
      "src/esaml_binding.erl",
      "src/esaml_cowboy.erl"
    ],
    "collectionURL": "https://repo.hex.pm",
    "defaultStatus": "unaffected",
    "programRoutines": [
      {
        "name": "esaml_binding:decode_response/2"
      },
      {
        "name": "esaml_cowboy:validate_assertion/2"
      },
      {
        "name": "esaml_cowboy:validate_logout/2"
      }
    ]
  },
  {
    "cpes": [
      "cpe:2.3:a:dropbox:esaml:*:*:*:*:*:*:*:*"
    ],
    "repo": "https://github.com/dropbox/esaml",
    "vendor": "dropbox",
    "modules": [
      "esaml_binding",
      "esaml_cowboy"
    ],
    "product": "esaml",
    "versions": [
      {
        "status": "affected",
        "version": "deeb84378d5c82153b470e99d24f77c38afca14a",
        "lessThan": "*",
        "versionType": "git"
      }
    ],
    "packageURL": "pkg:github/dropbox/esaml",
    "packageName": "dropbox/esaml",
    "programFiles": [
      "src/esaml_binding.erl",
      "src/esaml_cowboy.erl"
    ],
    "collectionURL": "https://github.com",
    "defaultStatus": "unaffected",
    "programRoutines": [
      {
        "name": "esaml_binding:decode_response/2"
      },
      {
        "name": "esaml_cowboy:validate_assertion/2"
      },
      {
        "name": "esaml_cowboy:validate_logout/2"
      }
    ]
  }
]
Related CVEs
CVE-2026-93471

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#50142 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement