Vulnerability-Lookup

GHSA-3GV4-V3M4-W3VP

Vulnerability from github – Published: 2026-10-22 09:31 – Updated: 2026-10-22 09:31

Details

esaml_binding:decode_response/2 base64-decodes the attacker-supplied SAMLResponse, inflates it with zlib:unzip/1 with no bound on the output, then converts the result to a charlist with binary_to_list/1 before parsing. This runs on the SAML consume (ACS) and single-logout endpoints, which accept unauthenticated requests by design, and it runs before any signature check. A small deflate stream reaches a compression ratio near 1000 to 1, so a request body of tens of kilobytes inflates to hundreds of megabytes and then to several gigabytes of list heap, so a few requests exhaust memory and take the node down.

This issue affects esaml: from 0.1.0 onward.

Severity

8.7 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-93471"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-409"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-22T09:17:16Z",
    "severity": "HIGH"
  },
  "details": "Improper Handling of Highly Compressed Data (Data Amplification) in esaml_binding in dropbox esaml allows an unauthenticated attacker to exhaust server memory and crash the Erlang VM via a crafted compressed SAMLResponse.\n\nesaml_binding:decode_response/2 base64-decodes the attacker-supplied SAMLResponse, inflates it with zlib:unzip/1 with no bound on the output, then converts the result to a charlist with binary_to_list/1 before parsing. This runs on the SAML consume (ACS) and single-logout endpoints, which accept unauthenticated requests by design, and it runs before any signature check. A small deflate stream reaches a compression ratio near 1000 to 1, so a request body of tens of kilobytes inflates to hundreds of megabytes and then to several gigabytes of list heap, so a few requests exhaust memory and take the node down.\n\nThis issue affects esaml: from 0.1.0 onward.",
  "id": "GHSA-3gv4-v3m4-w3vp",
  "modified": "2026-10-22T09:31:48Z",
  "published": "2026-10-22T09:31:48Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93471"
    },
    {
      "type": "WEB",
      "url": "https://github.com/arekinath/esaml/commit/deeb84378d5c82153b470e99d24f77c38afca14a"
    },
    {
      "type": "WEB",
      "url": "https://github.com/dropbox/esaml/commit/deeb84378d5c82153b470e99d24f77c38afca14a"
    },
    {
      "type": "WEB",
      "url": "https://github.com/handnot2/esaml/commit/deeb84378d5c82153b470e99d24f77c38afca14a"
    },
    {
      "type": "WEB",
      "url": "https://cna.erlef.org/cves/CVE-2026-93471.html"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-93471"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

CVE-2026-93471 (GCVE-0-2026-93471)

Vulnerability from cvelistv5 – Published: 2026-10-22 06:59 – Updated: 2026-10-22 06:59

Title

Unbounded SAML message decompression in esaml allows memory exhaustion

Summary

Improper Handling of Highly Compressed Data (Data Amplification) in esaml_binding in dropbox esaml allows an unauthenticated attacker to exhaust server memory and crash the Erlang VM via a crafted compressed SAMLResponse. esaml_binding:decode_response/2 base64-decodes the attacker-supplied SAMLResponse, inflates it with zlib:unzip/1 with no bound on the output, then converts the result to a charlist with binary_to_list/1 before parsing. This runs on the SAML consume (ACS) and single-logout endpoints, which accept unauthenticated requests by design, and it runs before any signature check. A small deflate stream reaches a compression ratio near 1000 to 1, so a request body of tens of kilobytes inflates to hundreds of megabytes and then to several gigabytes of list heap, so a few requests exhaust memory and take the node down. This issue affects esaml: from 0.1.0 onward.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

CWE

CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification)

Assigner

EEF CNA under the mitre root

CNA scorecard A 96/100 over 318 records in the last 180 days details

References

5 references

URL	Tags
https://cna.erlef.org/cves/CVE-2026-93471.html	relatedthird-party-advisory
https://osv.dev/vulnerability/EEF-CVE-2026-93471	related
https://github.com/handnot2/esaml/commit/deeb8437…	related
https://github.com/arekinath/esaml/commit/deeb843…	related
https://github.com/dropbox/esaml/commit/deeb84378…	relatedbroken-link

Impacted products

4 products

Vendor	Product	Version
handnot2	esaml	Affected: deeb84378d5c82153b470e99d24f77c38afca14a , < * (git) cpe:2.3:a:handnot2:esaml::::::::
arekinath	esaml	Affected: deeb84378d5c82153b470e99d24f77c38afca14a , < * (git) cpe:2.3:a:arekinath:esaml::::::::
dropbox	esaml	Affected: 0.1.0 , < * (semver) cpe:2.3:a:dropbox:esaml::::::::
dropbox	esaml	Affected: deeb84378d5c82153b470e99d24f77c38afca14a , < * (git) cpe:2.3:a:dropbox:esaml::::::::

Credits

Quinn Wilton Jonatan Männchen / EEF Jonatan Männchen / EEF

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:handnot2:esaml:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "esaml_binding",
            "esaml_cowboy"
          ],
          "packageName": "handnot2/esaml",
          "packageURL": "pkg:github/handnot2/esaml",
          "product": "esaml",
          "programFiles": [
            "src/esaml_binding.erl",
            "src/esaml_cowboy.erl"
          ],
          "programRoutines": [
            {
              "name": "esaml_binding:decode_response/2"
            },
            {
              "name": "esaml_cowboy:validate_assertion/2"
            },
            {
              "name": "esaml_cowboy:validate_logout/2"
            }
          ],
          "repo": "https://github.com/handnot2/esaml",
          "vendor": "handnot2",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "deeb84378d5c82153b470e99d24f77c38afca14a",
              "versionType": "git"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:arekinath:esaml:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "esaml_binding",
            "esaml_cowboy"
          ],
          "packageName": "arekinath/esaml",
          "packageURL": "pkg:github/arekinath/esaml",
          "product": "esaml",
          "programFiles": [
            "src/esaml_binding.erl",
            "src/esaml_cowboy.erl"
          ],
          "programRoutines": [
            {
              "name": "esaml_binding:decode_response/2"
            },
            {
              "name": "esaml_cowboy:validate_assertion/2"
            },
            {
              "name": "esaml_cowboy:validate_logout/2"
            }
          ],
          "repo": "https://github.com/arekinath/esaml",
          "vendor": "arekinath",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "deeb84378d5c82153b470e99d24f77c38afca14a",
              "versionType": "git"
            }
          ]
        },
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:dropbox:esaml:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "esaml_binding",
            "esaml_cowboy"
          ],
          "packageName": "esaml",
          "packageURL": "pkg:hex/esaml",
          "product": "esaml",
          "programFiles": [
            "src/esaml_binding.erl",
            "src/esaml_cowboy.erl"
          ],
          "programRoutines": [
            {
              "name": "esaml_binding:decode_response/2"
            },
            {
              "name": "esaml_cowboy:validate_assertion/2"
            },
            {
              "name": "esaml_cowboy:validate_logout/2"
            }
          ],
          "repo": "https://github.com/dropbox/esaml",
          "vendor": "dropbox",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0.1.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:dropbox:esaml:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "esaml_binding",
            "esaml_cowboy"
          ],
          "packageName": "dropbox/esaml",
          "packageURL": "pkg:github/dropbox/esaml",
          "product": "esaml",
          "programFiles": [
            "src/esaml_binding.erl",
            "src/esaml_cowboy.erl"
          ],
          "programRoutines": [
            {
              "name": "esaml_binding:decode_response/2"
            },
            {
              "name": "esaml_cowboy:validate_assertion/2"
            },
            {
              "name": "esaml_cowboy:validate_logout/2"
            }
          ],
          "repo": "https://github.com/dropbox/esaml",
          "vendor": "dropbox",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "deeb84378d5c82153b470e99d24f77c38afca14a",
              "versionType": "git"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:handnot2:esaml:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "2.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:dropbox:esaml:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "0.1.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Quinn Wilton"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Jonatan M\u00e4nnchen / EEF"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Jonatan M\u00e4nnchen / EEF"
        }
      ],
      "dateAssigned": "2026-10-06T10:25:40.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eImproper Handling of Highly Compressed Data (Data Amplification) in \u003ccode\u003eesaml_binding\u003c/code\u003e in dropbox esaml allows an unauthenticated attacker to exhaust server memory and crash the Erlang VM via a crafted compressed \u003ccode\u003eSAMLResponse\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eesaml_binding:decode_response/2\u003c/code\u003e base64-decodes the attacker-supplied \u003ccode\u003eSAMLResponse\u003c/code\u003e, inflates it with \u003ccode\u003ezlib:unzip/1\u003c/code\u003e with no bound on the output, then converts the result to a charlist with \u003ccode\u003ebinary_to_list/1\u003c/code\u003e before parsing. This runs on the SAML consume (ACS) and single-logout endpoints, which accept unauthenticated requests by design, and it runs before any signature check. A small deflate stream reaches a compression ratio near 1000 to 1, so a request body of tens of kilobytes inflates to hundreds of megabytes and then to several gigabytes of list heap, so a few requests exhaust memory and take the node down.\u003c/p\u003e\n\u003cp\u003eThis issue affects esaml: from 0.1.0 onward.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Improper Handling of Highly Compressed Data (Data Amplification) in `esaml_binding` in dropbox esaml allows an unauthenticated attacker to exhaust server memory and crash the Erlang VM via a crafted compressed `SAMLResponse`.\n\n`esaml_binding:decode_response/2` base64-decodes the attacker-supplied `SAMLResponse`, inflates it with `zlib:unzip/1` with no bound on the output, then converts the result to a charlist with `binary_to_list/1` before parsing. This runs on the SAML consume (ACS) and single-logout endpoints, which accept unauthenticated requests by design, and it runs before any signature check. A small deflate stream reaches a compression ratio near 1000 to 1, so a request body of tens of kilobytes inflates to hundreds of megabytes and then to several gigabytes of list heap, so a few requests exhaust memory and take the node down.\n\nThis issue affects esaml: from 0.1.0 onward."
            }
          ],
          "value": "Improper Handling of Highly Compressed Data (Data Amplification) in esaml_binding in dropbox esaml allows an unauthenticated attacker to exhaust server memory and crash the Erlang VM via a crafted compressed SAMLResponse.\n\nesaml_binding:decode_response/2 base64-decodes the attacker-supplied SAMLResponse, inflates it with zlib:unzip/1 with no bound on the output, then converts the result to a charlist with binary_to_list/1 before parsing. This runs on the SAML consume (ACS) and single-logout endpoints, which accept unauthenticated requests by design, and it runs before any signature check. A small deflate stream reaches a compression ratio near 1000 to 1, so a request body of tens of kilobytes inflates to hundreds of megabytes and then to several gigabytes of list heap, so a few requests exhaust memory and take the node down.\n\nThis issue affects esaml: from 0.1.0 onward."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-231",
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eAn unauthenticated attacker reaches a SAML consume or single-logout endpoint and posts a small compressed \u003ccode\u003eSAMLResponse\u003c/code\u003e that inflates to gigabytes, exhausting memory. A few requests crash the Erlang VM and deny service to every user of the service provider.\u003c/p\u003e"
                },
                {
                  "base64": false,
                  "type": "text/markdown",
                  "value": "An unauthenticated attacker reaches a SAML consume or single-logout endpoint and posts a small compressed `SAMLResponse` that inflates to gigabytes, exhausting memory. A few requests crash the Erlang VM and deny service to every user of the service provider."
                }
              ],
              "value": "An unauthenticated attacker reaches a SAML consume or single-logout endpoint and posts a small compressed SAMLResponse that inflates to gigabytes, exhausting memory. A few requests crash the Erlang VM and deny service to every user of the service provider."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-409",
              "description": "CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-22T06:59:24.029Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "name": "EEF CNA record for CVE-2026-93471",
          "tags": [
            "related",
            "third-party-advisory"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-93471.html"
        },
        {
          "name": "OSV record EEF-CVE-2026-93471",
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-93471"
        },
        {
          "name": "Introducing commit deeb843 in handnot2/esaml",
          "tags": [
            "related"
          ],
          "url": "https://github.com/handnot2/esaml/commit/deeb84378d5c82153b470e99d24f77c38afca14a"
        },
        {
          "name": "Introducing commit deeb843 in arekinath/esaml",
          "tags": [
            "related"
          ],
          "url": "https://github.com/arekinath/esaml/commit/deeb84378d5c82153b470e99d24f77c38afca14a"
        },
        {
          "name": "Introducing commit deeb843 in dropbox/esaml",
          "tags": [
            "related",
            "broken-link"
          ],
          "url": "https://github.com/dropbox/esaml/commit/deeb84378d5c82153b470e99d24f77c38afca14a"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Unbounded SAML message decompression in esaml allows memory exhaustion",
      "x_proofOfConcept": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003col\u003e\n\u003cli\u003eBuild a \u003ccode\u003eSAMLResponse\u003c/code\u003e as the base64 of a raw deflate stream of a long run of identical bytes (for example 60 MB of zero bytes), which encodes to roughly 79 KB on the wire.\u003c/li\u003e\n\u003cli\u003ePost it to the service provider\u0027s SAML consume (ACS) endpoint as the \u003ccode\u003eSAMLResponse\u003c/code\u003e form field, with \u003ccode\u003eSAMLEncoding\u003c/code\u003e set to the DEFLATE URI, or omitted to take the default clause.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eesaml_binding:decode_response/2\u003c/code\u003e inflates the stream and converts it to a charlist before any signature check. A single request spikes the Erlang VM by several gigabytes. Repeat to exhaust memory and crash the node.\u003c/li\u003e\n\u003c/ol\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "1. Build a `SAMLResponse` as the base64 of a raw deflate stream of a long run of identical bytes (for example 60 MB of zero bytes), which encodes to roughly 79 KB on the wire.\n2. Post it to the service provider\u0027s SAML consume (ACS) endpoint as the `SAMLResponse` form field, with `SAMLEncoding` set to the DEFLATE URI, or omitted to take the default clause.\n3. `esaml_binding:decode_response/2` inflates the stream and converts it to a charlist before any signature check. A single request spikes the Erlang VM by several gigabytes. Repeat to exhaust memory and crash the node."
            }
          ],
          "value": "* Build a SAMLResponse as the base64 of a raw deflate stream of a long run of identical bytes (for example 60 MB of zero bytes), which encodes to roughly 79 KB on the wire.\n* Post it to the service provider\u0027s SAML consume (ACS) endpoint as the SAMLResponse form field, with SAMLEncoding set to the DEFLATE URI, or omitted to take the default clause.\n* esaml_binding:decode_response/2 inflates the stream and converts it to a charlist before any signature check. A single request spikes the Erlang VM by several gigabytes. Repeat to exhaust memory and crash the node."
        }
      ],
      "x_technicalAnalysis": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003cstrong\u003e1. Input.\u003c/strong\u003e The SAML consume (ACS) and single-logout endpoints read the request body and pass the \u003ccode\u003eSAMLResponse\u003c/code\u003e form field to \u003ccode\u003eesaml_binding:decode_response/2\u003c/code\u003e. The attacker\u0027s \u003ccode\u003eSAMLEncoding\u003c/code\u003e field selects the clause. Both clauses inflate: the explicit DEFLATE clause, and the default clause, which tries \u003ccode\u003ezlib:unzip/1\u003c/code\u003e inside a \u003ccode\u003ecatch\u003c/code\u003e whenever the body is not plain XML.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e2. Unbounded inflate.\u003c/strong\u003e \u003ccode\u003edecode_response/2\u003c/code\u003e evaluates \u003ccode\u003ebinary_to_list(zlib:unzip(base64:decode(SAMLResponse)))\u003c/code\u003e. \u003ccode\u003ezlib:unzip/1\u003c/code\u003e inflates the whole stream in one call with no cap on output size, and \u003ccode\u003ebinary_to_list/1\u003c/code\u003e then expands the inflated binary to a charlist, which costs about 16 bytes of heap per byte on a 64-bit VM.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e3. Exhaustion before any check.\u003c/strong\u003e All of this happens before \u003ccode\u003exmerl_scan\u003c/code\u003e parses the document and before \u003ccode\u003eesaml_sp\u003c/code\u003e verifies any signature. A deflate stream of a long run of identical bytes reaches a ratio near 1000 to 1, so a request body of tens of kilobytes produces hundreds of megabytes of binary and then several gigabytes of list heap. A few concurrent requests exhaust memory and crash the node.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "**1. Input.** The SAML consume (ACS) and single-logout endpoints read the request body and pass the `SAMLResponse` form field to `esaml_binding:decode_response/2`. The attacker\u0027s `SAMLEncoding` field selects the clause. Both clauses inflate: the explicit DEFLATE clause, and the default clause, which tries `zlib:unzip/1` inside a `catch` whenever the body is not plain XML.\n\n**2. Unbounded inflate.** `decode_response/2` evaluates `binary_to_list(zlib:unzip(base64:decode(SAMLResponse)))`. `zlib:unzip/1` inflates the whole stream in one call with no cap on output size, and `binary_to_list/1` then expands the inflated binary to a charlist, which costs about 16 bytes of heap per byte on a 64-bit VM.\n\n**3. Exhaustion before any check.** All of this happens before `xmerl_scan` parses the document and before `esaml_sp` verifies any signature. A deflate stream of a long run of identical bytes reaches a ratio near 1000 to 1, so a request body of tens of kilobytes produces hundreds of megabytes of binary and then several gigabytes of list heap. A few concurrent requests exhaust memory and crash the node."
            }
          ],
          "value": "1. Input. The SAML consume (ACS) and single-logout endpoints read the request body and pass the SAMLResponse form field to esaml_binding:decode_response/2. The attacker\u0027s SAMLEncoding field selects the clause. Both clauses inflate: the explicit DEFLATE clause, and the default clause, which tries zlib:unzip/1 inside a catch whenever the body is not plain XML.\n\n2. Unbounded inflate. decode_response/2 evaluates binary_to_list(zlib:unzip(base64:decode(SAMLResponse))). zlib:unzip/1 inflates the whole stream in one call with no cap on output size, and binary_to_list/1 then expands the inflated binary to a charlist, which costs about 16 bytes of heap per byte on a 64-bit VM.\n\n3. Exhaustion before any check. All of this happens before xmerl_scan parses the document and before esaml_sp verifies any signature. A deflate stream of a long run of identical bytes reaches a ratio near 1000 to 1, so a request body of tens of kilobytes produces hundreds of megabytes of binary and then several gigabytes of list heap. A few concurrent requests exhaust memory and crash the node."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-93471",
    "datePublished": "2026-10-22T06:59:24.029Z",
    "dateReserved": "2026-10-06T08:45:01.518Z",
    "dateUpdated": "2026-10-22T06:59:24.029Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted