Unbounded atom creation while parsing SAML messages in esaml allows atom table exhaustion
Affects esaml from 0.1.0 onward, through its SAML consume (ACS) and single-logout endpoints, which parse unauthenticated requests before any signature check. No fix is listed yet.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Unclear
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: poc
- Automatable: yes
- Technical impact: partial
Summary
The esaml library, a Erlang implementation of SAML used for single sign-on, is affected. An unauthenticated attacker can send a specially crafted SAML response that makes the Erlang runtime create an unlimited number of permanent internal names, eventually exhausting its atom table and crashing the entire node.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Allocation of Resources Without Limits or Throttling vulnerability in esaml_binding in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the node via a crafted SAMLResponse. esaml_binding:decode_response/2 parses the decoded SAMLResponse with xmerl_scan:string/2, which interns every element name, attribute name, and namespace prefix it reads as a permanent atom. The SAML consume (ACS) and single-logout endpoints call it on unauthenticated requests before any signature check, so one well-formed document with thousands of distinct names mints thousands of atoms while staying inside the 128 KB request body limit. Atoms are never reclaimed and the VM caps the atom table at about one million entries, so a few dozen requests abort the node. This issue affects esaml: from 0.1.0 onward.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: poc · Automatable: yes · Technical impact: partial
- Record last updated
Affected versions
- arekinath/esaml
Version range not reported
- handnot2/esaml
Version range not reported
- esaml
From 0.1.0
- dropbox/esaml
Version range not reported
- esamlHex
From 0.1.0
References 5
cna.erlef.org
GitHub · arekinath/esaml
GitHub · handnot2/esaml
GitHub · dropbox/esaml
Questions about CVE-2026-105270
What does this mean?
The SAML consume (ACS) and single-logout endpoints create Erlang atoms from incoming SAMLResponse data before checking the signature. Because the atom table has a fixed size, a crafted message can fill it and crash the node, causing denial of service.Source: cna.erlef.org
Am I affected, and how do I check?
The issue affects esaml from 0.1.0 onward. To check a project, look at the esaml version pinned in its dependency file and whether it serves the SAML consume (ACS) or single-logout endpoints.Source: cna.erlef.org
What should I do about it?
The facts list no fixed version, so no upgrade target is confirmed. Check the advisory for an updated release before deciding what to install.Source: cna.erlef.org
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. CISA's SSVC assessment notes a proof of concept exists. No public exploit code is tracked.Source: cve.now feed data
What if there's no patch?
The sources do not list a workaround. The affected feature is the SAML consume (ACS) and single-logout endpoints, so limiting those endpoints is the only lever the facts identify, but no vendor-recommended steps are given.Source: cna.erlef.org