Dropbox vulnerabilities
We track 8 vulnerabilities in Dropbox products across 5 products. 8 are rated high or critical, and none are known to be exploited. The most recent was published on October 22, 2026.
Latest Dropbox vulnerabilities
- 8.7 High severity
esaml: Improper Handling of Highly Compressed Data (Data Amplification)
Improper Handling of Highly Compressed Data (Data Amplification) in esaml_binding in dropbox esaml allows an unauthenticated attacker to exhaust server memory and crash the Erlang VM via a crafted compressed SAMLResponse. esaml_binding:decode_response/2 base64
- 8.2 High severity
esaml: Allocation of Resources Without Limits or Throttling
Allocation of Resources Without Limits or Throttling vulnerability in esaml in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the node via unsigned LogoutResponse messages. esaml:status_code_map/1 in src/esaml.er
- 8.7 High severity
esaml: Allocation of Resources Without Limits or Throttling
Allocation of Resources Without Limits or Throttling vulnerability in esaml_binding in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the node via a crafted SAMLResponse. esaml_binding:decode_response/2 parses th
- 7.6 High severity
samly: Insufficient Verification of Data Authenticity
Insufficient Verification of Data Authenticity vulnerability in dropbox samly allows an attacker to establish an authenticated session using a SAML response the service provider never requested. Samly.SPHandler.validate_authresp/3 in lib/samly/sp_handler.ex va
- 9.1 Critical severity
samly: Authentication Bypass by Capture-replay
Authentication Bypass by Capture-replay vulnerability in dropbox samly allows an attacker to authenticate as the subject of a captured SAML assertion by resubmitting it. Samly.Helper.decode_idp_auth_resp/3 in lib/samly/helper.ex calls esaml_sp:validate_asserti
- 8.8 High severity
Dropbox Desktop: Protection Mechanism Failure
Dropbox Desktop Folder Sharing Mark-of-the-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of Dropbox Desktop. User interaction is required to exploit this vulner
- 9.8 Critical severity
In the Samly package before 1.4.0 for Elixir, Samly.State.Store.get_assertion/3 can return an…
In the Samly package before 1.4.0 for Elixir, Samly.State.Store.get_assertion/3 can return an expired session, which interferes with access control because Samly.AuthHandler uses a cached session and does not replace it, even after expiry.
- 9.8 Critical severity
merou: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in Dropbox merou. It has been classified as critical. Affected is the function add_public_key of the file grouper/public_key.py of the component SSH Public Key Handler. The manipulation of the argument public_key_str leads to injectio