esaml
Hex4 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting esamlpage 1 of 1
- CVE-2026-105270HIGHCVSS 8.7EG 8.72026-10-22
vulnerable: 3.0.1 ... 4.6.0 (16 versions)
Allocation of Resources Without Limits or Throttling vulnerability in esaml_binding in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the node via a crafted SAMLResponse. esaml_binding:decod…
- CVE-2026-28809MEDIUMCVSS 5.3EG 5.32026-03-23
vulnerable: 3.0.1 ... 4.6.0 (16 versions)
XML External Entity (XXE) vulnerability in esaml (and its forks) allows an attacker to cause the system to read local files and incorporate their contents into processed SAML documents, and potentially perform SSRF via crafted SAML message…
- CVE-2026-86696HIGHCVSS 8.2EG 8.22026-10-22
vulnerable: 3.0.1 ... 4.6.0 (16 versions)
Allocation of Resources Without Limits or Throttling vulnerability in esaml in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the node via unsigned LogoutResponse messages. esaml:status_code…
- CVE-2026-93471HIGHCVSS 8.7EG 8.72026-10-22
vulnerable: 3.0.1 ... 4.6.0 (16 versions)
Improper Handling of Highly Compressed Data (Data Amplification) in esaml_binding in dropbox esaml allows an unauthenticated attacker to exhaust server memory and crash the Erlang VM via a crafted compressed SAMLResponse. esaml_binding:de…
Check whether esaml is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for esaml CVEs against the assets you own.
Book a Demo →