esaml vulnerabilities

3 known vulnerabilities in esaml from Handnot2. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.7 High severity

  esaml: Improper Handling of Highly Compressed Data (Data Amplification)

  CVE-2026-93471Oct 22, 2026Handnot2

  Improper Handling of Highly Compressed Data (Data Amplification) in esaml_binding in dropbox esaml allows an unauthenticated attacker to exhaust server memory and crash the Erlang VM via a crafted compressed SAMLResponse. esaml_binding:decode_response/2 base64

• 8.2 High severity

  esaml: Allocation of Resources Without Limits or Throttling

  CVE-2026-86696Oct 22, 2026Handnot2

  Allocation of Resources Without Limits or Throttling vulnerability in esaml in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the node via unsigned LogoutResponse messages. esaml:status_code_map/1 in src/esaml.er

• 8.7 High severity

  esaml: Allocation of Resources Without Limits or Throttling

  CVE-2026-105270Oct 22, 2026Arekinath

  Allocation of Resources Without Limits or Throttling vulnerability in esaml_binding in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the node via a crafted SAMLResponse. esaml_binding:decode_response/2 parses th