Improper Handling of Highly Compressed Data in Dropbox esaml

CVE-2026-93471

What is CVE-2026-93471?

A vulnerability in Dropbox's esaml product allows unauthenticated attackers to exploit improper handling of highly compressed data. By crafting a manipulated SAMLResponse, attackers can execute an exploitation technique that exhausts server memory, leading to a crash of the Erlang VM. The flagrant inflating mechanism leads to memory bloat due to the absence of constraints on the output size during base64 decoding and decompression processes. This potentially allows attackers to incapacitate services relying on the vulnerable SAML consume and single-logout endpoints. Affected versions include esaml from 0.1.0 onward.

References