Esaml
Monthly
Unauthenticated memory exhaustion in the Erlang esaml SAML library (version 0.1.0 and later) lets a remote attacker crash the hosting Erlang VM by posting a small, highly compressed SAMLResponse to a service provider's assertion-consumer (ACS) or single-logout endpoint. Because esaml_binding:decode_response/2 base64-decodes and inflates the attacker-supplied payload with zlib:unzip/1 before any signature check, a deflate stream with roughly 1000:1 amplification expands tens of kilobytes into hundreds of megabytes of binary and then gigabytes of charlist heap, so only a handful of requests are needed to take the node down. No public exploit code or confirmed active exploitation was identified at time of analysis, but the issue is trivially reachable on any internet-facing esaml service provider and upstream fix commits are already published.
Unauthenticated remote denial of service in the Erlang SAML library esaml (0.1.0 and later) allows an attacker to abort an Erlang node by exhausting its atom table through unsigned LogoutResponse messages posted to a Service Provider's single-logout endpoint. Because esaml_sp:validate_logout_response/2 only verifies a signature when one is present, an unsigned message reaches esaml:decode_logout_response/1, where status_code_map/1 converts each unrecognized StatusCode into a permanent atom with list_to_atom/1 - roughly one million distinct status values (the VM's default atom-table ceiling) are enough to crash the node. The CNA scored this CVSS 4.0 8.2 with the AT:P attack-requirement metric; the practical barrier is volume and time rather than skill, and no public exploit code or confirmed active exploitation was identified at time of analysis.
A SSRF vulnerability (CVSS 6.3) that allows an attacker. Remediation should follow standard vulnerability management procedures.
Unauthenticated memory exhaustion in the Erlang esaml SAML library (version 0.1.0 and later) lets a remote attacker crash the hosting Erlang VM by posting a small, highly compressed SAMLResponse to a service provider's assertion-consumer (ACS) or single-logout endpoint. Because esaml_binding:decode_response/2 base64-decodes and inflates the attacker-supplied payload with zlib:unzip/1 before any signature check, a deflate stream with roughly 1000:1 amplification expands tens of kilobytes into hundreds of megabytes of binary and then gigabytes of charlist heap, so only a handful of requests are needed to take the node down. No public exploit code or confirmed active exploitation was identified at time of analysis, but the issue is trivially reachable on any internet-facing esaml service provider and upstream fix commits are already published.
Unauthenticated remote denial of service in the Erlang SAML library esaml (0.1.0 and later) allows an attacker to abort an Erlang node by exhausting its atom table through unsigned LogoutResponse messages posted to a Service Provider's single-logout endpoint. Because esaml_sp:validate_logout_response/2 only verifies a signature when one is present, an unsigned message reaches esaml:decode_logout_response/1, where status_code_map/1 converts each unrecognized StatusCode into a permanent atom with list_to_atom/1 - roughly one million distinct status values (the VM's default atom-table ceiling) are enough to crash the node. The CNA scored this CVSS 4.0 8.2 with the AT:P attack-requirement metric; the practical barrier is volume and time rather than skill, and no public exploit code or confirmed active exploitation was identified at time of analysis.
A SSRF vulnerability (CVSS 6.3) that allows an attacker. Remediation should follow standard vulnerability management procedures.