CVE-2026-93471 Details
Description
Improper Handling of Highly Compressed Data (Data Amplification) in esaml_binding in dropbox esaml allows an unauthenticated attacker to exhaust server memory and crash the Erlang VM via a crafted compressed SAMLResponse. esaml_binding:decode_response/2 base64-decodes the attacker-supplied SAMLResponse, inflates it with zlib:unzip/1 with no bound on the output, then converts the result to a charlist with binary_to_list/1 before parsing. This runs on the SAML consume (ACS) and single-logout endpoints, which accept unauthenticated requests by design, and it runs before any signature check. A small deflate stream reaches a compression ratio near 1000 to 1, so a request body of tens of kilobytes inflates to hundreds of megabytes and then to several gigabytes of list heap, so a few requests exhaust memory and take the node down. This issue affects esaml: from 0.1.0 onward.
A denial-of-service vulnerability has been identified in the Dropbox esaml library, specifically within the 'esaml_binding' component. This issue allows an unauthenticated attacker to send a crafted, compressed SAML response that, when processed, exhausts server memory and crashes the Erlang virtual machine. The vulnerability arises because the 'decode_response/2' function base64-decodes the SAML response, inflates it using 'zlib:unzip/1' without any output size limit, and then converts the inflated data into a character list. This process occurs on the SAML consume (ACS) and single-logout endpoints, which are designed to accept unauthenticated requests. Notably, the exploitation takes place before any signature verification is performed. The vulnerability affects all versions of esaml from 0.1.0 onwards.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 22, 2026CISA-ADP
Assessed Oct 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cna.erlef.org/cves/CVE-2026-93471.html | CISA-ADP | AdvisoryExploit |
| https://osv.dev/vulnerability/EEF-CVE-2026-93471 | CISA-ADP | AdvisoryExploit |
| https://cna.erlef.org/cves/CVE-2026-93471.html | EEF | AdvisoryExploit |
| https://github.com/arekinath/esaml/commit/deeb84378d5c82153b470e99d24f77c38afca14a | EEF | Source CodeVendor |
| https://github.com/dropbox/esaml/commit/deeb84378d5c82153b470e99d24f77c38afca14a | EEF | Broken LinkSource CodeVendor |
| https://github.com/handnot2/esaml/commit/deeb84378d5c82153b470e99d24f77c38afca14a | EEF | Source CodeVendor |
| https://osv.dev/vulnerability/EEF-CVE-2026-93471 | EEF | AdvisoryExploit |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-409 | Improper Handling of Highly Compressed Data (Data Amplification) | EEF |
Affected Products
| Product | Versions |
|---|---|
| Dropbox esaml | >= 0.1.0 (semver) |
CPE
Remediation
| |
| Handnot2 esaml | >= deeb843 |
CPE
Remediation
| |
| Arekinath esaml | >= deeb843 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 30, 2026 | CVE Modified | CISA-ADP |
| Oct 22, 2026 | New CVE Received | EEF |