CVE-2026-93471 Dropbox CVE debrief

Who should care

Defenders responsible for maintaining and securing systems that use the esaml library should assess exposure and prioritize patching or mitigating this vulnerability to prevent potential memory exhaustion attacks.

Why it matters

This vulnerability allows an unauthenticated attacker to potentially cause a denial-of-service (DoS) attack by crashing the Erlang VM, leading to memory exhaustion. Defenders should prioritize verifying affected versions, assessing exposure, and applying patches or mitigations to prevent potential attacks.

• Memory exhaustion leading to potential system crashes
• Potential for denial-of-service (DoS) attacks
• Need for verification of affected versions and exposure
• Prioritization of patching or mitigation efforts

Technical summary

The esaml library is vulnerable to a memory exhaustion attack due to improper handling of highly compressed data. An unauthenticated attacker can send a crafted compressed SAMLResponse to crash the Erlang VM. The vulnerability is caused by improper handling of highly compressed data in the esaml_binding module, specifically in the decode_response/2 function. This function base64-decodes the attacker-supplied SAMLResponse, inflates it with zlib:unzip/1 with no bound on the output, and then converts the result to a charlist with binary_to_list/1 before parsing. A small deflate stream reaches a compression ratio near 1000 to 1, so a request body of tens of kilobytes inflates to hundreds of megabytes and then to

Defensive priority

Defenders should prioritize verifying affected versions, assessing exposure, and applying patches or mitigations to prevent potential memory exhaustion attacks.

Recommended defensive actions

• Verify if the esaml library is used in the environment and assess exposure
• Check if the affected versions are in use and apply patches or mitigations
• Monitor for potential memory exhaustion attacks
• Consider implementing compensating controls to limit the impact of potential attacks
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability is caused by improper handling of highly compressed data in the esaml_binding module, specifically in the decode_response/2 function. This function base64-decodes the attacker-supplied SAMLResponse, inflates it with zlib:unzip/1 with no bound on the output, and then converts the result to a charlist with binary_to_list/1 before parsing.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.