CVE-2026-93471

Name of the Vulnerable Software and Affected Versions esaml versions 0.1.0 and later

Description Improper handling of highly compressed data in esaml binding allows an unauthenticated attacker to exhaust server memory and crash the Erlang VM. The issue occurs when the esaml binding:decode response/2 function processes a crafted SAMLResponse by base64-decoding it and inflating it using zlib:unzip/1 without any bound on the output size. The result is then converted to a charlist via binary to list/1 before parsing. This process happens on the SAML consume (ACS) and single-logout endpoints before any signature checks are performed. Because a small deflate stream can achieve a compression ratio of nearly 1000 to 1, a request body of tens of kilobytes can inflate to hundreds of megabytes and subsequently several gigabytes of list heap, leading to memory exhaustion and a denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.