{"metadata": {"vulnerability": "CVE-2026-93471", "count": 11, "kinds": {"milestone": 4, "sighting": 1, "kev": 0, "other": 6}}, "data": [{"timestamp": "2026-10-06T08:45:01.518Z", "date_only": false, "value": "2026-10-06T08:45:01.518Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-93471", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-06T10:25:40Z", "date_only": false, "value": "2026-10-06T10:25:40.000Z", "kind": "other", "label": "Date Assigned", "source": "cvelistv5 / EEF", "record": "CVE-2026-93471", "field": "containers.cna.dateAssigned"}, {"timestamp": "2026-10-22T06:59:24.029Z", "date_only": false, "value": "2026-10-22T06:59:24.029Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-93471", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-22T06:59:24.029Z", "date_only": false, "value": "2026-10-22T06:59:24.029Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-93471", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-22T06:59:24.029Z", "date_only": false, "value": "2026-10-22T06:59:24.029Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / EEF", "record": "CVE-2026-93471", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-22T07:28:33.266Z", "date_only": false, "value": "2026-10-22T07:28:33.266481Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117483379937190051", "record": "CVE-2026-93471", "field": "creation_timestamp", "uuid": "e5e130ef-4d26-4d81-95e0-2afe3e155372", "content": "CVE-2026-93471 Unbounded SAML message decompression in esaml allows memory exhaustion Improper Handling of Highly Compressed Data (Data Amplification) in esaml_binding in dropbox esaml allows an unauthenticated attacker to exhaust server memory and crash the Erlang VM via a crafted compressed SAMLResponse.\nesaml_binding:decode_response/2 base64-decodes the attacker-supplied SAMLResponse, inflates it with zlib:unzip/1 with no bound on the output, then converts the result to a charlist with binary_to_list/1 before parsing. This runs on the SAML consume (ACS) and single-logout endpoints, which accept unauthenticated requests by design, and it runs before any signature check. A small deflate stream reaches a compression ratio near 1000 to 1, so a request body of tens of kilobytes inflates to hundreds of megabytes and then to several gigabytes of list heap, so a few requests exhaust memory and take the node down.\nThis issue affects esaml: from 0.1.0 onward.\nhttps://www.cve.org/CVERecord?id=CVE-2026-93471https://cna.erlef.org/cves/CVE-2026-93471.htmlhttps://osv.dev/vulnerability/EEF-CVE-2026-93471https://github.com/handnot2/esaml/commit/deeb84378d5c82153b470e99d24f77c38afca14ahttps://github.com/arekinath/esaml/commit/deeb84378d5c82153b470e99d24f77c38afca14ahttps://github.com/dropbox/esaml/commit/deeb84378d5c82153b470e99d24f77c38afca14a#handnot2 #esaml #arekinath #dropbox#CVE_2026_93471#bot", "url": "https://infosec.exchange/users/cve/statuses/117483379937190051"}, {"timestamp": "2026-10-22T09:17:16Z", "date_only": false, "value": "2026-10-22T09:17:16Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-3GV4-V3M4-W3VP", "record": "GHSA-3GV4-V3M4-W3VP", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-22T09:17:16.827Z", "date_only": false, "value": "2026-10-22T09:17:16.827", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-93471", "record": "FKIE_CVE-2026-93471", "field": "published"}, {"timestamp": "2026-10-22T09:31:48Z", "date_only": false, "value": "2026-10-22T09:31:48Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-3GV4-V3M4-W3VP", "record": "GHSA-3GV4-V3M4-W3VP", "field": "published"}, {"timestamp": "2026-10-22T09:31:48Z", "date_only": false, "value": "2026-10-22T09:31:48Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-3GV4-V3M4-W3VP", "record": "GHSA-3GV4-V3M4-W3VP", "field": "modified"}, {"timestamp": "2026-10-22T16:58:51.997Z", "date_only": false, "value": "2026-10-22T16:58:51.997", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-93471", "record": "FKIE_CVE-2026-93471", "field": "lastModified"}]}