CVE-2026-93471: esaml 0.1.0 to before *

Affected technology

esaml · deeb84378d5c82153b470e99d24f77c38afca14a to before *
handnot2

esaml · 0.1.0 to before *
dropbox

Component: esaml_binding, esaml_cowboy
Function: esaml_binding:decode_response/2, esaml_cowboy:validate_assertion/2, esaml_cowboy:validate_logout/2
File: src/esaml_binding.erl, src/esaml_cowboy.erl

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

An unauthenticated attacker can exhaust server memory and crash the Erlang VM via a crafted compressed SAMLResponse. esaml_binding:decode_response/2 base64-decodes the attacker-supplied SAMLResponse, inflates it with zlib:unzip/1 with no bound on the output, then converts the result to a charlist with binary_to_list/1 before parsing. Source advisory’s CVSS 4.0 assessment (base score 8.7/10) rates confidentiality and integrity impact as none; availability impact as high.