Skip to content
CVE PROGRAM SOURCE RECORD8.2 High

CVE-2026-86696

Unbounded atom creation from unsigned LogoutResponse status codes in esaml allows atom table exhaustion

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
EEF

Description

Allocation of Resources Without Limits or Throttling vulnerability in esaml in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the node via unsigned LogoutResponse messages. esaml:status_code_map/1 in src/esaml.erl maps any StatusCode value it does not recognize to an atom with list_to_atom/1 on the last colon-separated segment of the URN. esaml_sp:validate_logout_response/2 verifies a signature only when the message carries one, so an unsigned LogoutResponse posted to the single-logout endpoint reaches esaml:decode_logout_response/1 and mints one permanent atom per distinct status value. Atoms are never reclaimed and the VM caps the atom table at about one million entries, so an attacker who posts that many distinct values aborts the node. This issue affects esaml: from 0.1.0 onward.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

handnot2 esaml

Default version status: unaffected

  • be692b56245071899757afa7ef47e43593d3de96 to < *affected
pkg:github/handnot2/esaml

arekinath esaml

Default version status: unaffected

  • be692b56245071899757afa7ef47e43593d3de96 to < *affected
pkg:github/arekinath/esaml

dropbox esaml

Default version status: unaffected

  • 0.1.0 to < *affected
pkg:hex/esaml

dropbox esaml

Default version status: unaffected

  • be692b56245071899757afa7ef47e43593d3de96 to < *affected
pkg:github/dropbox/esaml

References