Read the docs
TI-2026-79218 Aliases CVE-2026-93471GHSA-3gv4-v3m4-w3vp

Unbounded SAML message decompression in esaml allows memory exhaustion

Priority HIGH 77CWE-409Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

The esaml SAML library from dropbox is affected from 0.1.0 onward. The esaml_binding decode_response function inflates attacker-supplied SAMLResponse data with no output limit, a data amplification flaw (CWE-409). An unauthenticated remote attacker sends a small compressed request that expands to gigabytes of memory, exhausting server memory and crashing the Erlang VM.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Description from the CNA

Improper Handling of Highly Compressed Data (Data Amplification) in esaml_binding in dropbox esaml allows an unauthenticated attacker to exhaust server memory and crash the Erlang VM via a crafted compressed SAMLResponse. esaml_binding:decode_response/2 base64-decodes the attacker-supplied SAMLResponse, inflates it with zlib:unzip/1 with no bound on the output, then converts the result to a charlist with binary_to_list/1 before parsing. This runs on the SAML consume (ACS) and single-logout endpoints, which accept unauthenticated requests by design, and it runs before any signature check. A small deflate stream reaches a compression ratio near 1000 to 1, so a request body of tens of kilobytes inflates to hundreds of megabytes and then to several gigabytes of list heap, so a few requests exhaust memory and take the node down. This issue affects esaml: from 0.1.0 onward.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0066 51st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
dropboxesaml0.1.0 and later—No fix listedCNA
  • esaml Vendordropbox Affected 0.1.0 and later Fixed in — No fix listed CNA

CPE names CNA · 3

CPEVersionsRoleVendor
cpe:2.3:a:handnot2:esaml:*:*:*:*:*:*:*:*——handnot2
cpe:2.3:a:arekinath:esaml:*:*:*:*:*:*:*:*——arekinath
cpe:2.3:a:dropbox:esaml:*:*:*:*:*:*:*:*——dropbox
  • cpe:2.3:a:handnot2:esaml:*:*:*:*:*:*:*:* Versions — — ·handnot2
  • cpe:2.3:a:arekinath:esaml:*:*:*:*:*:*:*:* Versions — — ·arekinath
  • cpe:2.3:a:dropbox:esaml:*:*:*:*:*:*:*:* Versions — — ·dropbox

Remediation

The sources list no fixed version for esaml.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Timeline

  1. 2026-10-22 Threatist record created from CVE-2026-93471
  2. 2026-10-22 Alias added: GHSA-3gv4-v3m4-w3vp
  3. 2026-10-23 Priority changed: MEDIUM → LOW
  4. 2026-10-30 CISA SSVC decision points changed
  5. 2026-10-30 Priority changed: LOW → HIGH
  6. 2026-10-31 EPSS moved to the 50th–90th percentile

References

Advisory 1

Other 4

  • TI-2026-79203 Unbounded atom creation in esaml SAML parsing crashes Erlang nodes CVSS 4.0HIGH 8.7
  • TI-2026-79217 Unbounded atom creation from unsigned LogoutResponse status codes in esaml allows atom table exhaustion CVSS 4.0HIGH 8.2
  • TI-2026-38506 Missing one-time-use enforcement in Samly allows replay of SAML bearer assertions CVSS 4.0CRITICAL 9.1
  • TI-2026-38507 Missing InResponseTo validation in Samly allows acceptance of unsolicited SAML responses CVSS 4.0HIGH 7.6
  • TI-2026-23003 XXE in esaml SAML library allows local file read and potential SSRF CVSS 4.0MEDIUM 6.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences