Handnot2
Monthly
Unauthenticated memory exhaustion in the Erlang esaml SAML library (version 0.1.0 and later) lets a remote attacker crash the hosting Erlang VM by posting a small, highly compressed SAMLResponse to a service provider's assertion-consumer (ACS) or single-logout endpoint. Because esaml_binding:decode_response/2 base64-decodes and inflates the attacker-supplied payload with zlib:unzip/1 before any signature check, a deflate stream with roughly 1000:1 amplification expands tens of kilobytes into hundreds of megabytes of binary and then gigabytes of charlist heap, so only a handful of requests are needed to take the node down. No public exploit code or confirmed active exploitation was identified at time of analysis, but the issue is trivially reachable on any internet-facing esaml service provider and upstream fix commits are already published.
Unauthenticated remote denial of service in the Erlang SAML library esaml (0.1.0 and later) allows an attacker to abort an Erlang node by exhausting its atom table through unsigned LogoutResponse messages posted to a Service Provider's single-logout endpoint. Because esaml_sp:validate_logout_response/2 only verifies a signature when one is present, an unsigned message reaches esaml:decode_logout_response/1, where status_code_map/1 converts each unrecognized StatusCode into a permanent atom with list_to_atom/1 - roughly one million distinct status values (the VM's default atom-table ceiling) are enough to crash the node. The CNA scored this CVSS 4.0 8.2 with the AT:P attack-requirement metric; the practical barrier is volume and time rather than skill, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Authentication bypass via SAML assertion replay affects Samly, the Elixir/Plug SAML 2.0 Service Provider library from Dropbox, in all releases from v0.3.0 onward. Because Samly.Helper.decode_idp_auth_resp/3 invokes esaml's validate_assertion with a no-op duplicate detector and exposes no way to supply a real one, a bearer assertion is never enforced as single-use; an attacker who captures a single valid SAMLResponse can resubmit the identical bytes to repeatedly log in as that assertion's subject until its NotOnOrAfter expires. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Authentication bypass in the Elixir SAML library samly (v0.3.0+) allows an attacker holding a validly IdP-signed SAML assertion to establish an authenticated session on the service provider without the SP ever having issued the corresponding AuthnRequest. The root cause is that Samly.SPHandler.validate_authresp/3 never persists the AuthnRequest ID and therefore cannot compare it against the SubjectConfirmationData/@InResponseTo attribute in incoming responses, violating SAML 2.0 Core §4.1.4.3. No public exploit has been identified at time of analysis, but the attack is technically accessible to any party who holds a legitimately signed IdP assertion and can obtain a victim's RelayState value.
A SSRF vulnerability (CVSS 6.3) that allows an attacker. Remediation should follow standard vulnerability management procedures.
Unauthenticated memory exhaustion in the Erlang esaml SAML library (version 0.1.0 and later) lets a remote attacker crash the hosting Erlang VM by posting a small, highly compressed SAMLResponse to a service provider's assertion-consumer (ACS) or single-logout endpoint. Because esaml_binding:decode_response/2 base64-decodes and inflates the attacker-supplied payload with zlib:unzip/1 before any signature check, a deflate stream with roughly 1000:1 amplification expands tens of kilobytes into hundreds of megabytes of binary and then gigabytes of charlist heap, so only a handful of requests are needed to take the node down. No public exploit code or confirmed active exploitation was identified at time of analysis, but the issue is trivially reachable on any internet-facing esaml service provider and upstream fix commits are already published.
Unauthenticated remote denial of service in the Erlang SAML library esaml (0.1.0 and later) allows an attacker to abort an Erlang node by exhausting its atom table through unsigned LogoutResponse messages posted to a Service Provider's single-logout endpoint. Because esaml_sp:validate_logout_response/2 only verifies a signature when one is present, an unsigned message reaches esaml:decode_logout_response/1, where status_code_map/1 converts each unrecognized StatusCode into a permanent atom with list_to_atom/1 - roughly one million distinct status values (the VM's default atom-table ceiling) are enough to crash the node. The CNA scored this CVSS 4.0 8.2 with the AT:P attack-requirement metric; the practical barrier is volume and time rather than skill, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Authentication bypass via SAML assertion replay affects Samly, the Elixir/Plug SAML 2.0 Service Provider library from Dropbox, in all releases from v0.3.0 onward. Because Samly.Helper.decode_idp_auth_resp/3 invokes esaml's validate_assertion with a no-op duplicate detector and exposes no way to supply a real one, a bearer assertion is never enforced as single-use; an attacker who captures a single valid SAMLResponse can resubmit the identical bytes to repeatedly log in as that assertion's subject until its NotOnOrAfter expires. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Authentication bypass in the Elixir SAML library samly (v0.3.0+) allows an attacker holding a validly IdP-signed SAML assertion to establish an authenticated session on the service provider without the SP ever having issued the corresponding AuthnRequest. The root cause is that Samly.SPHandler.validate_authresp/3 never persists the AuthnRequest ID and therefore cannot compare it against the SubjectConfirmationData/@InResponseTo attribute in incoming responses, violating SAML 2.0 Core §4.1.4.3. No public exploit has been identified at time of analysis, but the attack is technically accessible to any party who holds a legitimately signed IdP assertion and can obtain a victim's RelayState value.
A SSRF vulnerability (CVSS 6.3) that allows an attacker. Remediation should follow standard vulnerability management procedures.