CVE-2026-93471: esaml: Unbounded SAML message decompression allows memory exhaustion

Summary

The Erlang SAML library esaml, used as a SAML service provider, decompresses attacker-supplied SAMLResponse data without any size limit. Unauthenticated requests to the SAML consume and single-logout endpoints are processed before any signature check. A small compressed request can expand to several gigabytes of memory, so a few requests can exhaust memory, crash the Erlang VM and deny service to users.

Affected

esaml (Hex package) from 0.1.0 onward
Git-based repositories of dropbox, arekinath and handnot2 esaml from commit deeb843 onward

Fixed in

Unknown. No fixed version has been identified.

Workaround

Unknown. A request-size cap alone may not be sufficient, because a small compressed body can expand far beyond it.

Exploitation

CISA SSVC: proof of concept available, automatable: yes, technical impact: partial
The CNA record describes a simple proof of concept using a crafted deflate stream

Our recommendation

Check whether esaml is used in your SAML service provider and which versions are deployed
Restrict or filter access to the SAML consume and single-logout endpoints where possible
Apply memory limits and monitor the Erlang VM for memory spikes and restarts
Track the vendor and CNA record for an official fix and update as soon as one is available

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

CNA record CVE-2026-93471 (ERLEF) cna.erlef.org
OSV record EEF-CVE-2026-93471 osv.dev
Commit deeb843 in dropbox/esaml github.com
Commit deeb843 in arekinath/esaml github.com
Commit deeb843 in handnot2/esaml github.com
ServiceRadar issue 6052 (esaml status) github.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 00:54.

Original description (NVD)

Improper Handling of Highly Compressed Data (Data Amplification) in esaml_binding in dropbox esaml allows an unauthenticated attacker to exhaust server memory and crash the Erlang VM via a crafted compressed SAMLResponse. esaml_binding:decode_response/2 base64-decodes the attacker-supplied SAMLResponse, inflates it with zlib:unzip/1 with no bound on the output, then converts the result to a charlist with binary_to_list/1 before parsing. This runs on the SAML consume (ACS) and single-logout endpoints, which accept unauthenticated requests by design, and it runs before any signature check. A small deflate stream reaches a compression ratio near 1000 to 1, so a request body of tens of kilobytes inflates to hundreds of megabytes and then to several gigabytes of list heap, so a few requests exhaust memory and take the node down. This issue affects esaml: from 0.1.0 onward.

NVD references (7)

Sources

The tracker combines official, freely usable data sources – updated continuously:

NVD (NIST) – CVEs, rating (CVSS), affected products
CISA KEV – vulnerabilities confirmed by CISA as actively exploited
CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
FIRST EPSS – probability of exploitation
Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
PoC-in-GitHub – public proof-of-concept repositories
Metasploit (Rapid7) – modules of the Metasploit Framework
Exploit-DB (OffSec) – archive of public exploits (links only)
Patch days: official vendor pages (linked per vendor) (Vendor patch days)

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touch RSS feed