handnot2/esaml vulnerabilities
CVEs whose affected-version data names the handnot2/esaml package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
3 CVEsRSS
CVE-2026-93471High· 8.7Unbounded SAML message decompression in esaml allows memory exhaustion
Improper Handling of Highly Compressed Data (Data Amplification) in esaml_binding in dropbox esaml allows an unauthenticated attacker to exhaust server memory and crash the Erlang VM via a crafted compressed SAMLResponse. esaml_binding:…
CVE-2026-86696High· 8.2Unbounded atom creation from unsigned LogoutResponse status codes in esaml allows atom table exhaustion
Allocation of Resources Without Limits or Throttling vulnerability in esaml in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the node via unsigned LogoutResponse messages. esaml:status_co…
CVE-2026-105270High· 8.7Unbounded atom creation while parsing SAML messages in esaml allows atom table exhaustion
Allocation of Resources Without Limits or Throttling vulnerability in esaml_binding in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the node via a crafted SAMLResponse. esaml_binding:dec…