These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A memory exhaustion vulnerability exists in the esaml library, which allows an unauthenticated attacker to crash the Erlang VM by sending a crafted compressed SAMLResponse. This issue affects esaml versions from 0.1.0 onward. The vulnerability is caused by improper handling of highly compressed data in the esaml_binding module, specifically in the decode_response/2 function. This function base64-decodes t [truncated]
An Allocation of Resources Without Limits or Throttling vulnerability in esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the node via unsigned LogoutResponse messages. This issue affects esaml from version 0.1.0 onward. Defenders should prioritize verifying exposure and assessing the impact of this vulnerability on their systems, especially those using esaml. The vul [truncated]
CVE-2026-105270 is an Allocation of Resources Without Limits or Throttling vulnerability in esaml_binding in dropbox esaml. This vulnerability allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the node via a crafted SAMLResponse. The vulnerability arises from the esaml_binding:decode_response/2 function, which parses SAMLResponse with xmerl_scan:string/2, interning every ele [truncated]