Skip to content
Heist/ feed
High

Unbounded atom creation while parsing SAML messages in esaml allows atom table exhaustion

Type: advisorySource: Official CVE List1 source record

Allocation of Resources Without Limits or Throttling vulnerability in esaml_binding in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the node via a crafted SAMLResponse. esaml_binding:decode_response/2 parses the decoded SAMLResponse with xmerl_scan:string/2, which interns every element name, attribute name, and namespace prefix it reads as a permanent atom. The SAML consume (ACS) and single-logout endpoints call it on unauthenticated requests before any signature check, so one well-formed document with thousands of distinct names mints thousands of atoms while staying inside the 128 KB request body limit. Atoms are never reclaimed and the VM caps the atom table at about one million entries, so a few dozen requests abort the node. This issue affects esaml: from 0.1.0 onward.

Announced Source revision 1
Original source ↗

CVE-2026-105270

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-105270

esaml

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

esaml

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

esaml

Source reference: /containers/cna/affected/2/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

esaml

Source reference: /containers/cna/affected/3/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "cpes": [
      "cpe:2.3:a:arekinath:esaml:*:*:*:*:*:*:*:*"
    ],
    "repo": "https://github.com/arekinath/esaml",
    "vendor": "arekinath",
    "modules": [
      "esaml_binding",
      "esaml_cowboy"
    ],
    "product": "esaml",
    "versions": [
      {
        "status": "affected",
        "version": "deeb84378d5c82153b470e99d24f77c38afca14a",
        "lessThan": "*",
        "versionType": "git"
      }
    ],
    "packageURL": "pkg:github/arekinath/esaml",
    "packageName": "arekinath/esaml",
    "programFiles": [
      "src/esaml_binding.erl",
      "src/esaml_cowboy.erl"
    ],
    "collectionURL": "https://github.com",
    "defaultStatus": "unaffected",
    "programRoutines": [
      {
        "name": "esaml_binding:decode_response/2"
      },
      {
        "name": "esaml_cowboy:validate_assertion/2"
      },
      {
        "name": "esaml_cowboy:validate_logout/2"
      }
    ]
  },
  {
    "cpes": [
      "cpe:2.3:a:handnot2:esaml:*:*:*:*:*:*:*:*"
    ],
    "repo": "https://github.com/handnot2/esaml",
    "vendor": "handnot2",
    "modules": [
      "esaml_binding",
      "esaml_cowboy"
    ],
    "product": "esaml",
    "versions": [
      {
        "status": "affected",
        "version": "deeb84378d5c82153b470e99d24f77c38afca14a",
        "lessThan": "*",
        "versionType": "git"
      }
    ],
    "packageURL": "pkg:github/handnot2/esaml",
    "packageName": "handnot2/esaml",
    "programFiles": [
      "src/esaml_binding.erl",
      "src/esaml_cowboy.erl"
    ],
    "collectionURL": "https://github.com",
    "defaultStatus": "unaffected",
    "programRoutines": [
      {
        "name": "esaml_binding:decode_response/2"
      },
      {
        "name": "esaml_cowboy:validate_assertion/2"
      },
      {
        "name": "esaml_cowboy:validate_logout/2"
      }
    ]
  },
  {
    "cpes": [
      "cpe:2.3:a:dropbox:esaml:*:*:*:*:*:*:*:*"
    ],
    "repo": "https://github.com/dropbox/esaml",
    "vendor": "dropbox",
    "modules": [
      "esaml_binding",
      "esaml_cowboy"
    ],
    "product": "esaml",
    "versions": [
      {
        "status": "affected",
        "version": "0.1.0",
        "lessThan": "*",
        "versionType": "semver"
      }
    ],
    "packageURL": "pkg:hex/esaml",
    "packageName": "esaml",
    "programFiles": [
      "src/esaml_binding.erl",
      "src/esaml_cowboy.erl"
    ],
    "collectionURL": "https://repo.hex.pm",
    "defaultStatus": "unaffected",
    "programRoutines": [
      {
        "name": "esaml_binding:decode_response/2"
      },
      {
        "name": "esaml_cowboy:validate_assertion/2"
      },
      {
        "name": "esaml_cowboy:validate_logout/2"
      }
    ]
  },
  {
    "cpes": [
      "cpe:2.3:a:dropbox:esaml:*:*:*:*:*:*:*:*"
    ],
    "repo": "https://github.com/dropbox/esaml",
    "vendor": "dropbox",
    "modules": [
      "esaml_binding",
      "esaml_cowboy"
    ],
    "product": "esaml",
    "versions": [
      {
        "status": "affected",
        "version": "deeb84378d5c82153b470e99d24f77c38afca14a",
        "lessThan": "*",
        "versionType": "git"
      }
    ],
    "packageURL": "pkg:github/dropbox/esaml",
    "packageName": "dropbox/esaml",
    "programFiles": [
      "src/esaml_binding.erl",
      "src/esaml_cowboy.erl"
    ],
    "collectionURL": "https://github.com",
    "defaultStatus": "unaffected",
    "programRoutines": [
      {
        "name": "esaml_binding:decode_response/2"
      },
      {
        "name": "esaml_cowboy:validate_assertion/2"
      },
      {
        "name": "esaml_cowboy:validate_logout/2"
      }
    ]
  }
]
Related CVEs
CVE-2026-105270

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#50136 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement