Skip to content
OpenAdvisories

Package · Hex

esaml

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Feed

  • High 8.7
    CVE-2026-93471

    Unbounded SAML message decompression in esaml allows memory exhaustion

    Improper Handling of Highly Compressed Data (Data Amplification) in esaml_binding in dropbox esaml allows an unauthenticated attacker to exhaust server memory and crash the Erlang VM via a crafted compressed SAMLResponse. esaml_binding:decode_response/2 base6…

    dropbox handnot2 arekinath esaml Hex
  • High 8.2
    CVE-2026-86696

    Unbounded atom creation from unsigned LogoutResponse status codes in esaml allows atom table exhaustion

    Allocation of Resources Without Limits or Throttling vulnerability in esaml in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the node via unsigned LogoutResponse messages. esaml:status_code_map/1 in src/esaml.e…

    dropbox handnot2 arekinath esaml Hex
  • High 8.7
    CVE-2026-105270

    Unbounded atom creation while parsing SAML messages in esaml allows atom table exhaustion

    Allocation of Resources Without Limits or Throttling vulnerability in esaml_binding in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the node via a crafted SAMLResponse. esaml_binding:decode_response/2 parses t…

    dropbox handnot2 arekinath esaml Hex
  • Medium 6.3
    CVE-2026-28809

    XXE in esaml SAML library allows local file read and potential SSRF

    XML External Entity (XXE) vulnerability in esaml (and its forks) allows an attacker to cause the system to read local files and incorporate their contents into processed SAML documents, and potentially perform SSRF via crafted SAML messages. esaml parses atta…

    dropbox handnot2 arekinath Jump-App Hex