{"id":"CVE-2026-93471","aliases":[],"cve":{"records":[{"id":"CVE-2026-93471","source":"EEF","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-06T08:45:01.518Z","published":"2026-10-22T06:59:24.029Z","modified":"2026-10-30T18:07:07.385Z"}],"publishers":[{"name":"EEF","role":"CNA","organizationId":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","modified":"2026-10-22T06:59:24.029Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-30T18:07:07.385Z"}],"references":[{"url":"https://cna.erlef.org/cves/CVE-2026-93471.html","tags":["related","third-party-advisory"],"source":"EEF"},{"url":"https://osv.dev/vulnerability/EEF-CVE-2026-93471","tags":["related"],"source":"EEF"},{"url":"https://github.com/handnot2/esaml/commit/deeb84378d5c82153b470e99d24f77c38afca14a","tags":["related"],"source":"EEF"},{"url":"https://github.com/arekinath/esaml/commit/deeb84378d5c82153b470e99d24f77c38afca14a","tags":["related"],"source":"EEF"},{"url":"https://github.com/dropbox/esaml/commit/deeb84378d5c82153b470e99d24f77c38afca14a","tags":["related","broken-link"],"source":"EEF"},{"url":"https://cna.erlef.org/cves/CVE-2026-93471.html","tags":["exploit"],"source":"CISA-ADP"},{"url":"https://osv.dev/vulnerability/EEF-CVE-2026-93471","tags":["exploit"],"source":"CISA-ADP"}],"weaknesses":[{"id":"CWE-409","description":"CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)","source":"EEF"}],"applicability":[{"source":"EEF","statements":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:handnot2:esaml:*:*:*:*:*:*:*:*","versionStartIncluding":"2.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:dropbox:esaml:*:*:*:*:*:*:*:*","versionStartIncluding":"0.1.0","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"AND"}]}],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-30T18:06:21.441852Z","decisions":[{"name":"Exploitation","value":"poc"},{"name":"Automatable","value":"yes"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Unbounded SAML message decompression in esaml allows memory exhaustion","titleSource":"EEF","descriptionSource":"EEF","description":"Improper Handling of Highly Compressed Data (Data Amplification) in esaml_binding in dropbox esaml allows an unauthenticated attacker to exhaust server memory and crash the Erlang VM via a crafted compressed SAMLResponse.\n\nesaml_binding:decode_response/2 base64-decodes the attacker-supplied SAMLResponse, inflates it with zlib:unzip/1 with no bound on the output, then converts the result to a charlist with binary_to_list/1 before parsing. This runs on the SAML consume (ACS) and single-logout endpoints, which accept unauthenticated requests by design, and it runs before any signature check. A small deflate stream reaches a compression ratio near 1000 to 1, so a request body of tens of kilobytes inflates to hundreds of megabytes and then to several gigabytes of list heap, so a few requests exhaust memory and take the node down.\n\nThis issue affects esaml: from 0.1.0 onward.","score":8.7,"severity":"high","published":"2026-10-22T06:59:24.029Z","modified":"2026-10-30T18:07:07.385Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"handnot2","name":"esaml","platforms":[],"versions":[{"version":"deeb84378d5c82153b470e99d24f77c38afca14a","status":"affected","lessThan":"*","versionType":"git"}],"defaultStatus":"unaffected","packageURL":"pkg:github/handnot2/esaml","cpes":["cpe:2.3:a:handnot2:esaml:*:*:*:*:*:*:*:*"],"source":"EEF","url":"https://www.cve.org/CVERecord?id=CVE-2026-93471"},{"vendor":"arekinath","name":"esaml","platforms":[],"versions":[{"version":"deeb84378d5c82153b470e99d24f77c38afca14a","status":"affected","lessThan":"*","versionType":"git"}],"defaultStatus":"unaffected","packageURL":"pkg:github/arekinath/esaml","cpes":["cpe:2.3:a:arekinath:esaml:*:*:*:*:*:*:*:*"],"source":"EEF","url":"https://www.cve.org/CVERecord?id=CVE-2026-93471"},{"vendor":"dropbox","name":"esaml","platforms":[],"versions":[{"version":"0.1.0","status":"affected","lessThan":"*","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:hex/esaml","packageIdentity":{"ecosystem":"Hex","name":"esaml"},"cpes":["cpe:2.3:a:dropbox:esaml:*:*:*:*:*:*:*:*"],"source":"EEF","url":"https://www.cve.org/CVERecord?id=CVE-2026-93471"},{"vendor":"dropbox","name":"esaml","platforms":[],"versions":[{"version":"deeb84378d5c82153b470e99d24f77c38afca14a","status":"affected","lessThan":"*","versionType":"git"}],"defaultStatus":"unaffected","packageURL":"pkg:github/dropbox/esaml","cpes":["cpe:2.3:a:dropbox:esaml:*:*:*:*:*:*:*:*"],"source":"EEF","url":"https://www.cve.org/CVERecord?id=CVE-2026-93471"}],"remediation":[],"references":["https://cna.erlef.org/cves/CVE-2026-93471.html","https://osv.dev/vulnerability/EEF-CVE-2026-93471","https://github.com/handnot2/esaml/commit/deeb84378d5c82153b470e99d24f77c38afca14a","https://github.com/arekinath/esaml/commit/deeb84378d5c82153b470e99d24f77c38afca14a","https://github.com/dropbox/esaml/commit/deeb84378d5c82153b470e99d24f77c38afca14a"],"sources":[{"name":"CVE","id":"CVE-2026-93471","modified":"2026-10-30T18:07:07.385Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-93471"}],"assessments":[{"source":"EEF","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":8.7}],"sourceAffected":[],"observedAt":"2026-10-30T19:13:15.249Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T11:50:31.946Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[],"aiSummary":{"text":"esaml versions from 0.1.0 onward are affected by improper handling of highly compressed data, allowing an unauthenticated attacker to exhaust server memory via a crafted compressed SAMLResponse. The vulnerability occurs in the esaml_binding:decode_response/2 function. This can cause the Erlang VM to crash.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-31T10:31:03.747Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-93471"}]}}