Key points
- CVE-2026-93471 allows memory exhaustion via crafted compressed SAML responses.
- The flaw exists in all versions of the esaml library from 0.1.0 onward.
- No patch or update has been confirmed by the vendor yet.
Teams managing identity services must address a severe vulnerability in the esaml library used by Dropbox and others. The flaw, tracked as CVE-2026-93471, carries a CVSS score of 8.7, which is rated high. It allows unauthenticated attackers to crash servers by sending small, highly compressed data packets that expand massively in memory.
In plain English
The issue stems from how the library handles incoming SAML authentication requests. When a user logs in, the server receives a compressed data stream. The esaml library decompresses this stream without checking how large the resulting data will be. An attacker can send a tiny file that expands into gigabytes of data, filling up the server's memory instantly.
The background
According to the NVD record, the vulnerability is classified as improper handling of highly compressed data. The specific function involved is esaml_binding:decode_response/2. This function processes requests on endpoints that accept unauthenticated traffic by design. The code inflates the data using zlib before converting it to a list structure, causing a massive spike in memory usage that crashes the Erlang virtual machine.
What changes now
This vulnerability affects the esaml library from version 0.1.0 onward. Multiple forks, including those by handnot2 and arekinath, are also affected. Because the flaw runs before signature verification, attackers do not need valid credentials to exploit it. A few requests can exhaust server resources, taking the node offline. No fix has been confirmed yet.
Who needs to act first
Security operations teams should prioritize systems that expose SAML endpoints to the public internet. Since no patch exists, the immediate goal is to reduce exposure. Teams usually implement network-level controls to limit request sizes or rate-limit connections to identity providers. Check whether load balancers can drop oversized payloads before they reach the application. Back up configuration files before making any changes to routing rules.
What to do and how to stay safe: Dropbox
- Monitor server memory usage for sudden spikes that do not correlate with normal traffic patterns.
- Configure web servers or proxies to reject HTTP requests with bodies larger than a reasonable threshold for SAML responses.
- Review firewall rules to restrict access to SAML assertion consumer service endpoints to known IP ranges if possible.
- Once the vendor provides an update, test the patch in a staging environment before deploying it to production servers.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-93471?
It is a high-severity vulnerability in the esaml library that allows attackers to crash servers via data amplification.
Which versions of esaml are affected?
All versions from 0.1.0 onward are vulnerable, including forks by handnot2 and arekinath.
Is there a fix available yet?
No, no patch or update has been confirmed by the vendor at this time.
