CVE-2026-93471

The record

Improper Handling of Highly Compressed Data (Data Amplification) in esaml_binding in dropbox esaml allows an unauthenticated attacker to exhaust server memory and crash the Erlang VM via a crafted compressed SAMLResponse. esaml_binding:decode_response/2 base64-decodes the attacker-supplied SAMLResponse, inflates it with zlib:unzip/1 with no bound on the output, then converts the result to a charlist with binary_to_list/1 before parsing. This runs on the SAML consume (ACS) and single-logout endpoints, which accept unauthenticated requests by design, and it runs before any signature check. A small deflate stream reaches a compression ratio near 1000 to 1, so a request body of tens of kilobytes inflates to hundreds of megabytes and then to several gigabytes of list heap, so a few requests exhaust memory and take the node down. This issue affects esaml: from 0.1.0 onward.

Affected packages

Related vulnerabilities

• CVE-2026-118761 Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning… CWE-409
• CVE-2026-118261 Echo is a Go web framework. CWE-409
• CVE-2026-111073 The broker-side PushTelemetry API (KIP-714) validates only the compressed size of a… CWE-409
• CVE-2026-116662 Tanium addressed a compression bomb vulnerability in Enforce. CWE-409
• CVE-2026-116579 Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted… CWE-409
• CVE-2026-65627 Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in… CWE-409
• CVE-2026-116175 vLLM from 0.19.0 before 0.24.0 contains a decompression bomb vulnerability because the… CWE-409
• CVE-2026-115638 OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results… CWE-409