{"id":"CVE-2026-93471","kind":"vulnerability","aliases":["CVE-2026-93471"],"related":[],"title":"esaml: crafted SAMLResponse exhausts memory and crashes Erlang VM","description":"Improper Handling of Highly Compressed Data (Data Amplification) in esaml_binding in dropbox esaml allows an unauthenticated attacker to exhaust server memory and crash the Erlang VM via a crafted compressed SAMLResponse.\n\nesaml_binding:decode_response/2 base64-decodes the attacker-supplied SAMLResponse, inflates it with zlib:unzip/1 with no bound on the output, then converts the result to a charlist with binary_to_list/1 before parsing. This runs on the SAML consume (ACS) and single-logout endpoints, which accept unauthenticated requests by design, and it runs before any signature check. A small deflate stream reaches a compression ratio near 1000 to 1, so a request body of tens of kilobytes inflates to hundreds of megabytes and then to several gigabytes of list heap, so a few requests exhaust memory and take the node down.\n\nThis issue affects esaml: from 0.1.0 onward.","summary":"esaml_binding:decode_response/2 inflates the attacker-supplied SAMLResponse with zlib:unzip/1 with no output cap, then binary_to_list/1, before any signature check. A request of tens of KB expands to GBs, so a few unauthenticated requests to the ACS or single-logout endpoint crash the Erlang VM. CVSS 4.0 8.7. All esaml versions from 0.1.0 are affected, including Hex 4.6.0; no fixed release is published as of 2026-10-23.","severity":"high","cvss":8.7,"epss":0.00438,"exploited":false,"exploited_at":null,"products":[{"name":"esaml","fixed":[],"affected":">= 0.1.0","ecosystem":"hex"}],"ecosystems":["hex"],"tags":["cowboy","elixir","erlang","esaml","package","saml","sso"],"not_affected_if":["esaml-not-used","no-saml-endpoints","no-saml-sp"],"how_to_check":"grep -i esaml rebar.lock mix.lock. Any esaml version is affected. Exposed if your app routes SAML ACS or SLO requests to esaml_cowboy:validate_assertion/2 or validate_logout/2, or calls esaml_binding:decode_response/2 on request bodies.","fix":"No patched Hex release known (4.6.0 still flagged). Until one exists: cap the request body size in front of the ACS/SLO endpoints (a reverse proxy limit of a few hundred KB), rate-limit them, and set a max_heap_size on request-handling processes. Watch hex.pm/packages/esaml and the dropbox/esaml, arekinath/esaml and handnot2/esaml repos for a fix.","status":"open","published_at":"2026-10-22T09:17:16+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-23T22:35:25+00:00","updated_at":"2026-10-24T07:15:51+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T22:35:25Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"esaml: crafted SAMLResponse exhausts memory and crashes Erlang VM","impact":"low","summary":"The esaml Erlang SAML library inflates the attacker-supplied SAMLResponse with no output limit before any signature check, so a small compressed payload expands to gigabytes. An unauthenticated attacker can exhaust server memory and crash the Erlang node with a few requests to the SAML consume or logout endpoints.","category":"package","who_cares":["erlang","elixir","saml","esaml"],"confidence":0.6,"needs_auth":"no","worst_case":"unauthenticated requests crash the node via memory exhaustion","analyst_note":"Find the patched esaml version and the fixed release in the dropbox/esaml repo or NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-93471; the sources do not name a fixed version.","how_to_check":"Check whether the esaml dependency is in your rebar.lock or mix.lock, e.g. grep -i esaml rebar.lock mix.lock; the sources do not give a command for runtime exposure.","needs_analyst":true,"not_affected_if":["no-saml-endpoints","esaml-not-used"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000549,"input_tokens":3138,"output_tokens":470,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the patched esaml version and the fixed release in the dropbox/esaml repo or NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-93471; the sources do not name a fixed version.","search":"'-10':96B '-2026':11A,14A '-23':97B '-93471':12A,15A '0.1.0':82B,240C '1':202C '1000':200C '2026':95B '4.0':76B '4.6.0':87B '8.7':77B 'ac':65B,172C 'accept':179C 'affect':84B,237C 'allow':112C 'amplif':105C 'attack':31B,115C,139C 'attacker-suppli':30B,138C 'base64':135C 'base64-decodes':134C 'binari':42B,161C 'bind':25B,108C,131C 'bodi':206C 'bound':149C 'cap':40B 'charlist':159C 'check':48B,190C 'compress':102C,128C,197C 'consum':171C 'convert':154C 'cowboy':17B 'craft':2A,127C 'crash':7A,71B,121C 'cve':10A,13A 'cvss':75B 'data':103C,104C 'decod':26B,132C,136C 'deflat':193C 'design':183C 'dropbox':110C 'elixir':18B 'endpoint':70B,177C 'erlang':8A,19B,73B,123C 'esaml':1A,16A,20B,24B,79B,107C,111C,130C,238C 'exhaust':4A,117C,228C 'expand':55B 'fix':89B 'gbs':57B 'gigabyt':220C 'handl':99C 'heap':223C 'hex':86B 'high':101C 'hundr':213C 'improp':98C 'includ':85B 'inflat':28B,142C,211C 'issu':236C 'kb':54B 'kilobyt':210C 'list':222C 'list/1':44B,163C 'logout':69B,176C 'megabyt':215C 'memori':5A,119C,229C 'near':199C 'node':233C 'onward':241C 'output':39B,152C 'packag':21B 'pars':165C 'publish':92B 'ratio':198C 'reach':195C 'releas':90B 'request':50B,62B,181C,205C,227C 'response/2':27B,133C 'result':156C 'run':167C,186C 'saml':22B,170C 'samlrespons':3A,33B,129C,141C 'server':118C 'sever':219C 'signatur':47B,189C 'singl':68B,175C 'single-logout':67B,174C 'small':192C 'sso':23B 'stream':194C 'suppli':32B,140C 'take':231C 'ten':52B,208C 'unauthent':61B,114C,180C 'unzip/1':36B,146C 'version':80B 'via':125C 'vm':9A,74B,124C 'zlib':35B,145C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T09:17:16+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-93471","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93471","severity":null,"published_at":"2026-10-22T09:17:16+00:00","modified_at":"2026-10-22T16:58:51+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-93471:507","url":null,"severity":null,"published_at":"2026-10-23T23:44:19+00:00","modified_at":"2026-10-23T23:44:19+00:00","first_seen_at":"2026-10-23T23:44:19+00:00","fetched_at":"2026-10-23T23:44:19+00:00","note":"EEF CNA advisory + Hex read. No fixed release named: Hex latest 4.6.0 is still flagged, affected >=0.1.0. Commit deeb843 is linked as fix but the CNA lists it as the affected-from git version, so it may be the introducing commit, not the patch; unverified. No X chatter, no exploitation reported; PoC described in advisory only. Sibling CVE-2026-105270 (atom table) cites the same commit."},{"source":"epss","external_id":"CVE-2026-93471","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-93471","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[{"id":2142,"url":"https://cna.erlef.org/cves/CVE-2026-93471.html","title":"EEF CNA: CVE-2026-93471 esaml unbounded decompression","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2136,"url":"https://hex.pm/packages/esaml/advisories","title":"Hex advisories for esaml","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":2144,"url":"https://github.com/dropbox/esaml/commit/deeb84378d5c82153b470e99d24f77c38afca14a","title":"esaml fix commit deeb843","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}