{"id":"EEF-CVE-2026-93471","summary":"Unbounded SAML message decompression in esaml allows memory exhaustion","details":"## Summary\n\nImproper Handling of Highly Compressed Data (Data Amplification) in `esaml_binding` in dropbox esaml allows an unauthenticated attacker to exhaust server memory and crash the Erlang VM via a crafted compressed `SAMLResponse`.\n\n`esaml_binding:decode_response/2` base64-decodes the attacker-supplied `SAMLResponse`, inflates it with `zlib:unzip/1` with no bound on the output, then converts the result to a charlist with `binary_to_list/1` before parsing. This runs on the SAML consume (ACS) and single-logout endpoints, which accept unauthenticated requests by design, and it runs before any signature check. A small deflate stream reaches a compression ratio near 1000 to 1, so a request body of tens of kilobytes inflates to hundreds of megabytes and then to several gigabytes of list heap, so a few requests exhaust memory and take the node down.\n\nThis issue affects esaml: from 0.1.0 onward.\n\n## Details\n\n**1. Input.** The SAML consume (ACS) and single-logout endpoints read the request body and pass the `SAMLResponse` form field to `esaml_binding:decode_response/2`. The attacker's `SAMLEncoding` field selects the clause. Both clauses inflate: the explicit DEFLATE clause, and the default clause, which tries `zlib:unzip/1` inside a `catch` whenever the body is not plain XML.\n\n**2. Unbounded inflate.** `decode_response/2` evaluates `binary_to_list(zlib:unzip(base64:decode(SAMLResponse)))`. `zlib:unzip/1` inflates the whole stream in one call with no cap on output size, and `binary_to_list/1` then expands the inflated binary to a charlist, which costs about 16 bytes of heap per byte on a 64-bit VM.\n\n**3. Exhaustion before any check.** All of this happens before `xmerl_scan` parses the document and before `esaml_sp` verifies any signature. A deflate stream of a long run of identical bytes reaches a ratio near 1000 to 1, so a request body of tens of kilobytes produces hundreds of megabytes of binary and then several gigabytes of list heap. A few concurrent requests exhaust memory and crash the node.\n\n## Proof of concept\n\n1. Build a `SAMLResponse` as the base64 of a raw deflate stream of a long run of identical bytes (for example 60 MB of zero bytes), which encodes to roughly 79 KB on the wire.\n2. Post it to the service provider's SAML consume (ACS) endpoint as the `SAMLResponse` form field, with `SAMLEncoding` set to the DEFLATE URI, or omitted to take the default clause.\n3. `esaml_binding:decode_response/2` inflates the stream and converts it to a charlist before any signature check. A single request spikes the Erlang VM by several gigabytes. Repeat to exhaust memory and crash the node.\n\n## Impact\n\nAn unauthenticated attacker reaches a SAML consume or single-logout endpoint and posts a small compressed `SAMLResponse` that inflates to gigabytes, exhausting memory. A few requests crash the Erlang VM and deny service to every user of the service provider.","aliases":["CVE-2026-93471"],"modified":"2026-10-22T07:00:03.393965193Z","published":"2026-10-22T06:59:24.029Z","database_specific":{"cpe_ids":["cpe:2.3:a:handnot2:esaml:*:*:*:*:*:*:*:*","cpe:2.3:a:arekinath:esaml:*:*:*:*:*:*:*:*","cpe:2.3:a:dropbox:esaml:*:*:*:*:*:*:*:*"],"cwe_ids":["CWE-409"],"capec_ids":["CAPEC-231"]},"references":[{"type":"WEB","url":"https://cna.erlef.org/cves/CVE-2026-93471.html"},{"type":"WEB","url":"https://github.com/handnot2/esaml/commit/deeb84378d5c82153b470e99d24f77c38afca14a"},{"type":"WEB","url":"https://github.com/arekinath/esaml/commit/deeb84378d5c82153b470e99d24f77c38afca14a"},{"type":"WEB","url":"https://github.com/dropbox/esaml/commit/deeb84378d5c82153b470e99d24f77c38afca14a"},{"type":"PACKAGE","url":"https://hex.pm/packages/esaml"}],"affected":[{"package":{"name":"esaml","ecosystem":"Hex","purl":"pkg:hex/esaml"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.1.0"}]}],"versions":["3.0.1","3.1.0","3.2.0","3.3.0","3.4.0","3.5.0","3.6.0","3.6.1","3.7.0","4.0.0","4.1.0","4.2.0","4.3.0","4.4.0","4.5.0","4.6.0"],"database_specific":{"source":"https://cna.erlef.org/osv/EEF-CVE-2026-93471.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/handnot2/esaml","events":[{"introduced":"deeb84378d5c82153b470e99d24f77c38afca14a"}]}],"versions":["v4.2.0","v3.6.1","v4.1.0","v4.0.0","v3.6.0","v3.5.0","v3.4.0","v3.3.0","v3.2.0","v3.1.0","v3.0.1","v3.0.0","v2.1.0","2.0.0","v1.1","v1.0","v0.1"],"database_specific":{"source":"https://cna.erlef.org/osv/EEF-CVE-2026-93471.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/arekinath/esaml","events":[{"introduced":"deeb84378d5c82153b470e99d24f77c38afca14a"}]}],"versions":["v1.1","v1.0","v0.1"],"database_specific":{"source":"https://cna.erlef.org/osv/EEF-CVE-2026-93471.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/dropbox/esaml","events":[{"introduced":"deeb84378d5c82153b470e99d24f77c38afca14a"}]}],"database_specific":{"source":"https://cna.erlef.org/osv/EEF-CVE-2026-93471.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"credits":[{"name":"Quinn Wilton","type":"REPORTER"},{"name":"Jonatan Männchen / EEF","type":"COORDINATOR"},{"name":"Jonatan Männchen / EEF","type":"ANALYST"}]}