Unbounded SAML message decompression in esaml allows memory exhaustion
Impact
Improper Handling of Highly Compressed Data (Data Amplification) in esaml_binding in dropbox esaml allows an unauthenticated attacker to exhaust server memory and crash the Erlang VM via a crafted compressed SAMLResponse.
Source excerpt · EEFAffected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
handnot2 · EEF
esaml
1 range
handnot2 · EEF
esaml
Package identity
pkg:github/handnot2/esamlIdentity supplied by EEF. Version matching requires compatible range evidence.
Compare with this publisher’s ranges. This does not inspect your installation.
affected
deeb84378d5c82153b470e99d24f77c38afca14a → before *
git versions
Other versions: unaffected
Product identifiers (CPE)
cpe:2.3:a:handnot2:esaml:*:*:*:*:*:*:*:*arekinath · EEF
esaml
1 range
arekinath · EEF
esaml
Package identity
pkg:github/arekinath/esamlIdentity supplied by EEF. Version matching requires compatible range evidence.
Compare with this publisher’s ranges. This does not inspect your installation.
affected
deeb84378d5c82153b470e99d24f77c38afca14a → before *
git versions
Other versions: unaffected
Product identifiers (CPE)
cpe:2.3:a:arekinath:esaml:*:*:*:*:*:*:*:*dropbox · EEF
esaml
1 range
dropbox · EEF
esaml
Package identity
pkg:hex/esamlExplore esaml →Identity supplied by EEF. Version matching requires compatible range evidence.
Compare with this publisher’s ranges. This does not inspect your installation.
affected
0.1.0 → before *
semver versions
Other versions: unaffected
Product identifiers (CPE)
cpe:2.3:a:dropbox:esaml:*:*:*:*:*:*:*:*dropbox · EEF
esaml
1 range
dropbox · EEF
esaml
Package identity
pkg:github/dropbox/esamlIdentity supplied by EEF. Version matching requires compatible range evidence.
Compare with this publisher’s ranges. This does not inspect your installation.
affected
deeb84378d5c82153b470e99d24f77c38afca14a → before *
git versions
Other versions: unaffected
Product identifiers (CPE)
cpe:2.3:a:dropbox:esaml:*:*:*:*:*:*:*:*Original source description
Improper Handling of Highly Compressed Data (Data Amplification) in esaml_binding in dropbox esaml allows an unauthenticated attacker to exhaust server memory and crash the Erlang VM via a crafted compressed SAMLResponse.
esaml_binding:decode_response/2 base64-decodes the attacker-supplied SAMLResponse, inflates it with zlib:unzip/1 with no bound on the output, then converts the result to a charlist with binary_to_list/1 before parsing. This runs on the SAML consume (ACS) and single-logout endpoints, which accept unauthenticated requests by design, and it runs before any signature check. A small deflate stream reaches a compression ratio near 1000 to 1, so a request body of tens of kilobytes inflates to hundreds of megabytes and then to several gigabytes of list heap, so a few requests exhaust memory and take the node down.
This issue affects esaml: from 0.1.0 onward.
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-93471View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
Environment requirements
These conditions apply together as specified by the publisher. A matching product name alone does not establish exposure.
EEF · platform conditions
All conditions must hold
Any condition may hold
Vulnerable product
cpe:2.3:a:handnot2:esaml:*:*:*:*:*:*:*:*From (inclusive): 2.0.0
Vulnerable product
cpe:2.3:a:dropbox:esaml:*:*:*:*:*:*:*:*From (inclusive): 0.1.0
Original applicability statements
[
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:handnot2:esaml:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:dropbox:esaml:*:*:*:*:*:*:*:*",
"versionStartIncluding": "0.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
]Contributing organizations · 2
Assigning organization
Additional data publisher
What changed
Follow changesLarge field values are marked as truncated previews. Original source snapshots remain retained.