Live › vulnerability › CVE-2026-105270
Go to dashboardesaml (Erlang SAML SP library, forks dropbox, arekinath and handnot2) parses the unauthenticated SAMLResponse with xmerl_scan:string/2 in esaml_binding:decode_response/2, before any signature check. xmerl turns every element, attribute and prefix name into a permanent atom. A document of about 33 KB with 10,000 distinct names adds 10,000 atoms, and a few dozen requests reach the roughly 1M atom limit and abort the BEAM node. The ACS and single-logout endpoints in esaml_cowboy are both reachable. Credit: Quinn Wilton. CVSS 4.0 8.7, CWE-770. The CNA lists no fix and no workaround.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| esaml | hex | >= 0.1.0 | – |
0.1.0 up is affected, including 4.6.0, the latest on HexEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Allocation of Resources Without Limits or Throttling vulnerability in esaml_binding in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the node via a crafted SAMLResponse.
esaml_binding:decode_response/2 parses the decoded SAMLResponse with xmerl_scan:string/2, which interns every element name, attribute name, and namespace prefix it reads as a permanent atom. The SAML consume (ACS) and single-logout endpoints call it on unauthenticated requests before any signature check, so one well-formed document with thousands of distinct names mints thousands of atoms while staying inside the 128 KB request body limit. Atoms are never reclaimed and the VM caps the atom table at about one million entries, so a few dozen requests abort the node.
This issue affects esaml: from 0.1.0 onward.
This page as .md · .json · in your agent: get_signal("CVE-2026-105270")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.