PT-2026-27105 · Erlang Solutions+2 · Erlang/Otp+2

Bryan Lynch · Published 2026-03-23 · Updated 2026-05-22 · CVE-2026-28809

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions esaml (and its forks) (affected versions not specified)

Description The software contains a flaw related to XML External Entity (XXE) processing. An attacker can potentially read local files and include their contents within processed SAML documents, and possibly perform Server-Side Request Forgery (SSRF) by using specially crafted SAML messages. The software parses SAML messages using xmerl scan:string/2 before signature verification, without disabling XML entity expansion. On Erlang/OTP versions prior to 27, Xmerl allows entities by default, which enables XXE attacks before signature verification. File contents may be exposed through logs or error messages even if signature verification fails.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2026-28809

GHSA-4G2H-VM7X-747C

Affected Products

Erlang/Otp

Esaml

Xmerl

References · 8

• https://github.com/Jump-App/esaml/commit/bab85efde7c136911402a881ca55173759467a26 · Patch
• https://osv.dev/vulnerability/EEF-CVE-2026-28809 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4g2h-vm7x-747c · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28809 · Security Note
• https://github.com/arekinath/esaml · Note
• https://t.me/cveNotify/164603 · Telegram Post
• https://twitter.com/CVEarity/status/2036119985307947147 · Twitter Post
• https://cna.erlef.org/cves/CVE-2026-28809.html · Note