Improper Handling of Highly Compressed Data (Data Amplification) in esaml_binding in dropbox esaml allows an unauthenticated attacker to exhaust… (CVE-2026-93471)

The vulnerability (CVE-2026-93471) exists in the esaml_binding:decode_response/2 function, which base64-decodes an attacker-supplied SAMLResponse and inflates it using zlib:unzip/1 without bounding the decompressed output size. The inflated data is then converted to a charlist before parsing. Since this processing occurs on unauthenticated SAML consume (ACS) and single-logout endpoints prior to signature verification, an attacker can send a crafted compressed SAMLResponse with a very high compression ratio (near 1000:1). This causes the server to inflate a small request into hundreds of megabytes or several gigabytes of memory usage, exhausting server memory and crashing the Erlang VM. The issue affects all esaml versions starting from 0.1.0.

An unauthenticated attacker can cause a denial of service by sending a specially crafted compressed SAMLResponse that consumes excessive server memory, leading to a crash of the Erlang VM hosting the esaml service. This disrupts availability of the affected service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider implementing input size limits or decompression resource constraints at the network or application layer to mitigate memory exhaustion risks.