CVE-2026-93471

Improper Handling of Highly Compressed Data Data Amplification in esamlbinding in dropbox esaml allows an unauthenticated attacker to exhaust server memory and crash the Erlang VM via a crafted compressed SAMLResponse. esamlbinding:decoderesponse/2 base64-decodes the attacker-supplied SAMLRespons...

CVE-2026-86696

Allocation of Resources Without Limits or Throttling vulnerability in esaml in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the node via unsigned LogoutResponse messages. esaml:statuscodemap/1 in src/esaml.erl maps any StatusCode value it does not...

CVE-2026-105270

Allocation of Resources Without Limits or Throttling vulnerability in esamlbinding in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the node via a crafted SAMLResponse. esamlbinding:decoderesponse/2 parses the decoded SAMLResponse with...

EUVD-2026-108052

Improper Handling of Highly Compressed Data Data Amplification in esamlbinding in dropbox esaml allows an unauthenticated attacker to exhaust server memory and crash the Erlang VM via a crafted compressed SAMLResponse. esamlbinding:decoderesponse/2 base64-decodes the attacker-supplied SAMLRespons...

CVE-2026-93471 Unbounded SAML message decompression in esaml allows memory exhaustion

Improper Handling of Highly Compressed Data Data Amplification in esamlbinding in dropbox esaml allows an unauthenticated attacker to exhaust server memory and crash the Erlang VM via a crafted compressed SAMLResponse. esamlbinding:decoderesponse/2 base64-decodes the attacker-supplied SAMLRespons...

CVE-2026-93471 Unbounded SAML message decompression in esaml allows memory exhaustion

Improper Handling of Highly Compressed Data Data Amplification in esamlbinding in dropbox esaml allows an unauthenticated attacker to exhaust server memory and crash the Erlang VM via a crafted compressed SAMLResponse. esamlbinding:decoderesponse/2 base64-decodes the attacker-supplied SAMLRespons...

CVE-2026-93471 Unbounded SAML message decompression in esaml allows memory exhaustion

Improper Handling of Highly Compressed Data Data Amplification in esamlbinding in dropbox esaml allows an unauthenticated attacker to exhaust server memory and crash the Erlang VM via a crafted compressed SAMLResponse. esamlbinding:decoderesponse/2 base64-decodes the attacker-supplied SAMLRespons...

CVE-2026-93471

The esaml library (version 0.1.0 and onward) is vulnerable to memory exhaustion due to improper handling of highly compressed data in the esaml_binding component. Specifically, the esaml_binding:decode_response/2 function base64-decodes a SAMLResponse and inflates it using zlib:unzip/1 without an...

EEF-CVE-2026-93471 Unbounded SAML message decompression in esaml allows memory exhaustion

Summary Improper Handling of Highly Compressed Data Data Amplification in esamlbinding in dropbox esaml allows an unauthenticated attacker to exhaust server memory and crash the Erlang VM via a crafted compressed SAMLResponse. esamlbinding:decoderesponse/2 base64-decodes the attacker-supplied...

CVE-2026-93471

Improper Handling of Highly Compressed Data Data Amplification in esamlbinding in dropbox esaml allows an unauthenticated attacker to exhaust server memory and crash the Erlang VM via a crafted compressed SAMLResponse. esamlbinding:decoderesponse/2 base64-decodes the attacker-supplied SAMLRespons...

EUVD-2026-108051

Allocation of Resources Without Limits or Throttling vulnerability in esaml in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the node via unsigned LogoutResponse messages. esaml:statuscodemap/1 in src/esaml.erl maps any StatusCode value it does not...

CVE-2026-86696 Unbounded atom creation from unsigned LogoutResponse status codes in esaml allows atom table exhaustion

Allocation of Resources Without Limits or Throttling vulnerability in esaml in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the node via unsigned LogoutResponse messages. esaml:statuscodemap/1 in src/esaml.erl maps any StatusCode value it does not...

CVE-2026-86696

The esaml library (version 0.1.0 and onward), used in dropbox esaml , is vulnerable to an Allocation of Resources Without Limits or Throttling (CWE-770) flaw. An unauthenticated attacker can exhaust the Erlang VM atom table and crash the node by sending unsigned LogoutResponse messages to the sin...

CVE-2026-86696 Unbounded atom creation from unsigned LogoutResponse status codes in esaml allows atom table exhaustion

Allocation of Resources Without Limits or Throttling vulnerability in esaml in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the node via unsigned LogoutResponse messages. esaml:statuscodemap/1 in src/esaml.erl maps any StatusCode value it does not...

EEF-CVE-2026-86696 Unbounded atom creation from unsigned LogoutResponse status codes in esaml allows atom table exhaustion

Summary Allocation of Resources Without Limits or Throttling vulnerability in esaml in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the node via unsigned LogoutResponse messages. esaml:statuscodemap/1 in src/esaml.erl maps any StatusCode value it...

CVE-2026-86696

Allocation of Resources Without Limits or Throttling vulnerability in esaml in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the node via unsigned LogoutResponse messages. esaml:statuscodemap/1 in src/esaml.erl maps any StatusCode value it does not...

CVE-2026-86696 Unbounded atom creation from unsigned LogoutResponse status codes in esaml allows atom table exhaustion

Allocation of Resources Without Limits or Throttling vulnerability in esaml in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the node via unsigned LogoutResponse messages. esaml:statuscodemap/1 in src/esaml.erl maps any StatusCode value it does not...

CVE-2026-105270 Unbounded atom creation while parsing SAML messages in esaml allows atom table exhaustion

Allocation of Resources Without Limits or Throttling vulnerability in esamlbinding in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the node via a crafted SAMLResponse. esamlbinding:decoderesponse/2 parses the decoded SAMLResponse with...

EEF-CVE-2026-105270 Unbounded atom creation while parsing SAML messages in esaml allows atom table exhaustion

Summary Allocation of Resources Without Limits or Throttling vulnerability in esamlbinding in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the node via a crafted SAMLResponse. esamlbinding:decoderesponse/2 parses the decoded SAMLResponse with...

CVE-2026-105270

The dropbox esaml library (version 0.1.0 and onward) is vulnerable to an Allocation of Resources Without Limits or Throttling vulnerability in the esaml_binding component. The esaml_binding:decode_response/2 function uses xmerl_scan:string/2 to parse SAMLResponse data, which interns every element...