Handnot2 vulnerabilities
We track 5 vulnerabilities in Handnot2 products across 2 products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on October 22, 2026.
Latest Handnot2 vulnerabilities
- 8.7 High severity
esaml: Improper Handling of Highly Compressed Data (Data Amplification)
Improper Handling of Highly Compressed Data (Data Amplification) in esaml_binding in dropbox esaml allows an unauthenticated attacker to exhaust server memory and crash the Erlang VM via a crafted compressed SAMLResponse. esaml_binding:decode_response/2 base64
- 8.2 High severity
esaml: Allocation of Resources Without Limits or Throttling
Allocation of Resources Without Limits or Throttling vulnerability in esaml in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the node via unsigned LogoutResponse messages. esaml:status_code_map/1 in src/esaml.er
- 8.7 High severity
esaml: Allocation of Resources Without Limits or Throttling
Allocation of Resources Without Limits or Throttling vulnerability in esaml_binding in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the node via a crafted SAMLResponse. esaml_binding:decode_response/2 parses th
- 7.6 High severity
samly: Insufficient Verification of Data Authenticity
Insufficient Verification of Data Authenticity vulnerability in dropbox samly allows an attacker to establish an authenticated session using a SAML response the service provider never requested. Samly.SPHandler.validate_authresp/3 in lib/samly/sp_handler.ex va
- 9.1 Critical severity
samly: Authentication Bypass by Capture-replay
Authentication Bypass by Capture-replay vulnerability in dropbox samly allows an attacker to authenticate as the subject of a captured SAML assertion by resubmitting it. Samly.Helper.decode_idp_auth_resp/3 in lib/samly/helper.ex calls esaml_sp:validate_asserti