CVE-2026-93471: esaml Unbounded SAML Message Decompression Leading to Memory Exhaustion
Summary
CVE-2026-93471: Unbounded SAML message decompression in esaml allows memory exhaustion. Affects esaml across 2 version ranges.
>= 0.1.0
>= deeb84378d5c82153b470e99d24f77c38afca14a
No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
esaml is an open-source library used for handling SAML (Security Assertion Markup Language) messages in Erlang applications. It facilitates secure communication between identity providers and service providers by enabling the exchange of authentication and authorization data. The library is designed to be flexible and support various SAML operations, including single sign-on and single logout. However, a critical vulnerability has been identified that allows unauthenticated attackers to exploit the library's handling of compressed SAML messages, leading to potential denial of service through memory exhaustion.
Vulnerability Detail
The vulnerability arises from improper handling of highly compressed data in the esaml_binding module. Specifically, the decode_response function base64-decodes the attacker-supplied SAMLResponse, inflates it using zlib:unzip/1 without any output size limitation, and then converts the result to a charlist. This process occurs before any signature verification, allowing an attacker to send a small compressed SAMLResponse that expands to several gigabytes of memory, ultimately crashing the Erlang VM. The issue affects all versions of esaml from 0.1.0 onward.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can implement input validation to limit the size of incoming SAMLResponse messages. Consider rejecting requests that exceed a certain size threshold or implementing rate limiting to mitigate the impact of potential attacks.
Conclusion
CVE-2026-93471 represents a significant security risk for applications using the esaml library, allowing attackers to exploit unbounded decompression of SAML messages. It is crucial for developers to update to the latest patched version of the library and implement necessary workarounds to protect their applications from potential denial of service attacks.
See every vulnerability recorded for esaml →
FAQ
CVE-2026-93471 is a vulnerability in the esaml library that allows unauthenticated attackers to exploit unbounded decompression of SAML messages, leading to memory exhaustion.
If your application uses the esaml library, an attacker could send specially crafted SAML messages that inflate to large sizes, potentially crashing your application and denying service to users.
All versions of esaml from 0.1.0 onward are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit the Vulert playground at Vulert Scanner to check if your application is affected without requiring signup.
The CVSS score of this vulnerability is 8.7, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for esaml.
