esaml CVE-2026-93471

Exploitable only when the affected esaml binding handler is deployed as a SAML service provider with its assertion-consumer (ACS) and/or single-logout endpoints reachable by the attacker; these endpoints accept unauthenticated requests by design and the vulnerable zlib:unzip/1 inflation in esaml_binding:decode_response/2 executes before any signature validation, so no credentials, user interaction, or non-default configuration are required. The only meaningful limiting factors are that the target must actually run esaml 0.1.0 or later and expose these SAML endpoints to the attacker (e.g. internet-facing SP), and that each crash requires only a few crafted requests to exhaust the Erlang node's memory. No special feature toggle is needed - the behavior is present in default SAML response/logout processing.

This is a genuine, pre-authentication denial-of-service issue that warrants prompt patching for anyone actually running esaml, though its blast radius is bounded by product prevalence rather than by exploit difficulty. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) is internally consistent with the description: the vulnerable code path is reached on the SAML consume (ACS) and single-logout endpoints, which accept unauthenticated requests by design, and the unbounded zlib:unzip/1 inflation runs before any signature check - so the PR:N/UI:N/AC:L claims are well supported by the source-level evidence, not just the narrative. Impact is availability-only (VC:N/VI:N/VA:H), correctly reflecting a crash/resource-exhaustion bug with no confidentiality or integrity loss; this is not a code-execution flaw despite the 8.7 'high' score. On exploitation signals, there is no CISA KEV listing, no EPSS probability supplied, and no public exploit referenced in the inputs, so this is not confirmed as actively exploited; the score is driven by ease of exploitation and reliability of impact, not by observed attacks. The practical priority is therefore 'patch quickly where deployed': trivially triggerable, unauthenticated, and reliable (a ~1000:1 compression ratio means tens of KB of request body becomes gigabytes of Erlang list heap), but the real-world footprint of this specific Erlang SAML library is small. Note the supplied CVSS is 4.0 only - no 3.1 vector was provided - and no EPSS/KEV/POC data was provided at all; absence of those signals is not evidence of safety for an exposed, internet-facing SP.

An attacker locates an internet-facing service provider that uses esaml and sends a small (tens of kilobytes) crafted, base64-encoded, DEFLATE-compressed SAMLResponse to its unauthenticated ACS or single-logout endpoint. esaml_binding:decode_response/2 base64-decodes and then inflates the stream with no output bound and converts it to an Erlang charlist, so a handful of such requests inflate to several gigabytes of list heap and exhaust memory, crashing the Erlang VM and taking the node offline. No public exploit is referenced in the inputs, but the technique is a well-understood decompression bomb and requires no authentication or user interaction.