CVE-2026-93471

{
  "etk_id": "ETK-2026-2415",
  "cve_id": "CVE-2026-93471",
  "display_id": "CVE-2026-93471",
  "ghsa_id": "GHSA-3gv4-v3m4-w3vp",
  "euvd_id": "EUVD-2026-108052",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unbounded decompression in esaml SAML response handling",
  "summary": "esaml versions 0.1.0 and later can expand compressed SAML responses without an output limit. An unauthenticated remote attacker can exhaust memory and terminate an Erlang VM when an exposed ACS or single-logout endpoint accepts a malicious compressed response.",
  "mitigation": "Upgrade handnot2/esaml to *; arekinath/esaml to *; esaml to *; dropbox/esaml to * or later.",
  "vendor": "handnot2",
  "product": "esaml",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= deeb84378d5c82153b470e99d24f77c38afca14a, < *"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "*"
      ],
      "package_name": "handnot2/esaml",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= deeb84378d5c82153b470e99d24f77c38afca14a, < *"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "*"
      ],
      "package_name": "arekinath/esaml",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0.1.0, < *"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "*"
      ],
      "package_name": "esaml",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= deeb84378d5c82153b470e99d24f77c38afca14a, < *"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "*"
      ],
      "package_name": "dropbox/esaml",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 8.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 23.276445333333335,
  "t0_at": "2026-10-22T06:59:24.029000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-22T06:59:24.029000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-22T06:59:24.029000+00:00",
      "url": "https://github.com/advisories/GHSA-3gv4-v3m4-w3vp"
    }
  }
}