The esaml library’s decode_response function base64‑decodes a supplied SAMLResponse, unzips it with zlib:unzip/1 without bounding the output size, and then converts the result into a large list before parsing. A small deflate stream can expand several megabytes into hundreds of megabytes or even gigabytes of list heap, which can exhaust the Erlang VM’s memory and cause a crash. The flaw is exercised by unauthenticated requests to the ACS and single‑logout endpoints, which run before any signature validation, meaning an attacker can trigger DoS simply by sending crafted compressed payloads.

The issue appears in the esaml library for several vendors: Arekinath’s esaml, Dropbox’s esaml, and Handnot2’s esaml, all versions from 0.1.0 onward. Any system integrating these libraries for SAML handling is potentially vulnerable.

With a CVSS score of 8.7 the vulnerability is high severity. The EPSS score is not available, but because the attack requires only a single unauthenticated HTTP request to a public endpoint and no special configuration, the exploitation likelihood is high. The vulnerability is not yet listed in the CISA KEV catalog. An attacker can send a tiny, highly compressed SAMLResponse that inflates thousands of times larger, quickly consuming system memory and bringing the node down.