Erlang esaml CVE-2026-93471: SAML Amplification Crashes Servers Before Verification
An unauthenticated attacker can crash Erlang servers using a small, crafted SAML payload that expands into gigabytes of memory before signature verification occurs.
Key points
- CVE-2026-93471 allows memory exhaustion via compressed data amplification in the esaml library.
- The flaw affects all versions of esaml from 0.1.0 onward across multiple repositories.
- Attackers exploit the vulnerability before signature checks, requiring no authentication.
The esaml library, widely used for SAML authentication in Erlang applications, contains a high-severity data amplification flaw. According to the National Vulnerability Database, CVE-2026-93471 allows an unauthenticated attacker to exhaust server memory and crash the Erlang Virtual Machine. The vulnerability resides in the esaml_binding module, specifically within the decode_response function. This function processes SAML responses without limiting the size of the decompressed data, creating a significant risk for any service relying on this library for identity management.
The risk
The vulnerability stems from improper handling of highly compressed data, classified under CWE-409. When the esaml library receives a SAMLResponse, it base64-decodes the input and then inflates it using zlib without imposing an output size bound. This process occurs before any cryptographic signature verification takes place. An attacker can submit a small deflate stream that achieves a compression ratio near one thousand to one. Consequently, a request body of only tens of kilobytes can inflate to hundreds of megabytes. This data is then converted to a character list, expanding further into several gigabytes of heap memory.
Who is exposed
This issue affects all versions of the esaml library starting from version 0.1.0. The flaw is present in the original dropbox esaml repository, as well as forks maintained by handnot2 and arekinath. The vulnerability runs on SAML consume endpoints and single-logout endpoints. These endpoints are designed to accept unauthenticated requests by nature of the SAML protocol. Because the decoding and inflation happen before signature validation, an attacker does not need valid credentials or a signed assertion to trigger the memory exhaustion. A few crafted requests can exhaust available memory and take the server node offline.
Cost and compliance
The National Vulnerability Database assigns a CVSS score of 8.7 to this vulnerability, rating it as high severity. The score reflects the ease of exploitation and the impact on system availability. No patch or update has been confirmed yet by the vendors. Organizations must assess their exposure based on the version of the esaml library they are currently running. Since the flaw affects all versions from the initial release, any system using this library is potentially vulnerable unless mitigations are applied.
What to watch
Security teams should monitor for unusual spikes in memory usage on servers handling SAML requests. Look for patterns of small incoming requests followed by rapid resource consumption. Verify that your deployment uses the latest available version of the esaml library or consider implementing upstream rate limiting. If you cannot update immediately, restrict access to SAML endpoints to known IP ranges where possible.
Signals worth monitoring
Teams usually detect data amplification attacks by observing disproportionate resource consumption relative to network traffic. Check whether your application logs show sudden increases in memory allocation during SAML processing. Monitor for repeated small POST requests to assertion consumer service endpoints that result in service instability. Look for Erlang VM crash dumps that cite memory exhaustion or list conversion errors. Verify that your monitoring tools alert on rapid heap growth that does not correlate with normal user activity patterns.
What to do and how to stay safe: esaml
- Review your inventory to identify any systems using the esaml library, particularly versions prior to a confirmed fix.
- Implement strict rate limiting on SAML assertion consumer and logout endpoints to reduce the volume of potential exploit attempts.
- Monitor server memory usage closely for anomalies that indicate data decompression attacks or resource exhaustion.
- Once the vendor provides an update, apply the patch immediately and verify that the library version no longer contains the vulnerable code.
Step-by-step guide: Vulnerability Prioritization: Fix What Actually Matters First
General security guidance from the SecOps Signal newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-93471?
The National Vulnerability Database rates the vulnerability as high severity with a CVSS score of 8.7.
Does the attacker need authentication to exploit this flaw?
No, the vulnerability allows an unauthenticated attacker to exploit the system via crafted compressed SAML responses.
Which versions of esaml are affected?
All versions of the esaml library from 0.1.0 onward are affected, including forks by handnot2 and arekinath.
