Live › vulnerability › CVE-2026-93471
Go to dashboardesaml_binding:decode_response/2 inflates the attacker-supplied SAMLResponse with zlib:unzip/1 with no output cap, then binary_to_list/1, before any signature check. A request of tens of KB expands to GBs, so a few unauthenticated requests to the ACS or single-logout endpoint crash the Erlang VM. CVSS 4.0 8.7. All esaml versions from 0.1.0 are affected, including Hex 4.6.0; no fixed release is published as of 2026-10-23.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| esaml | hex | >= 0.1.0 | – |
4.6.0 still flagged)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Handling of Highly Compressed Data (Data Amplification) in esaml_binding in dropbox esaml allows an unauthenticated attacker to exhaust server memory and crash the Erlang VM via a crafted compressed SAMLResponse.
esaml_binding:decode_response/2 base64-decodes the attacker-supplied SAMLResponse, inflates it with zlib:unzip/1 with no bound on the output, then converts the result to a charlist with binary_to_list/1 before parsing. This runs on the SAML consume (ACS) and single-logout endpoints, which accept unauthenticated requests by design, and it runs before any signature check. A small deflate stream reaches a compression ratio near 1000 to 1, so a request body of tens of kilobytes inflates to hundreds of megabytes and then to several gigabytes of list heap, so a few requests exhaust memory and take the node down.
This issue affects esaml: from 0.1.0 onward.
This page as .md · .json · in your agent: get_signal("CVE-2026-93471")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.