CVE-2026-105270 Details
Description
Allocation of Resources Without Limits or Throttling vulnerability in esaml_binding in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the node via a crafted SAMLResponse. esaml_binding:decode_response/2 parses the decoded SAMLResponse with xmerl_scan:string/2, which interns every element name, attribute name, and namespace prefix it reads as a permanent atom. The SAML consume (ACS) and single-logout endpoints call it on unauthenticated requests before any signature check, so one well-formed document with thousands of distinct names mints thousands of atoms while staying inside the 128 KB request body limit. Atoms are never reclaimed and the VM caps the atom table at about one million entries, so a few dozen requests abort the node. This issue affects esaml: from 0.1.0 onward.
A vulnerability in the `esaml_binding` component of Dropbox esaml, present in versions 0.1.0 and later, allows an unauthenticated attacker to cause a denial-of-service by exhausting the Erlang VM's atom table. This is achieved by sending a crafted SAML response that includes thousands of distinct element and attribute names. The `esaml_binding:decode_response/2` function processes the SAML response using `xmerl_scan:string/2`, which converts each name into a permanent atom. Since the atom table is capped at about one million entries and atoms are not garbage collected, a few dozen such requests can crash the node, disrupting service for all users.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 22, 2026CISA-ADP
Assessed Oct 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://osv.dev/vulnerability/EEF-CVE-2026-105270 | CISA-ADP | AdvisoryExploit |
| https://cna.erlef.org/cves/CVE-2026-105270.html | EEF | AdvisoryExploit |
| https://github.com/arekinath/esaml/commit/deeb84378d5c82153b470e99d24f77c38afca14a | EEF | Source CodeVendor |
| https://github.com/dropbox/esaml/commit/deeb84378d5c82153b470e99d24f77c38afca14a | EEF | Broken LinkSource CodeVendor |
| https://github.com/handnot2/esaml/commit/deeb84378d5c82153b470e99d24f77c38afca14a | EEF | Source CodeVendor |
| https://osv.dev/vulnerability/EEF-CVE-2026-105270 | EEF | AdvisoryExploit |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling | EEF |
Affected Products
| Product | Versions |
|---|---|
| Arekinath esaml | >= deeb843, < 0.1.0 |
CPE
Remediation
| |
| Handnot2 esaml | >= deeb843, < 0.1.0 |
CPE
Remediation
| |
| Dropbox esaml | >= 0.1.0 (semver) >= deeb843, < 0.1.0 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 30, 2026 | CVE Modified | CISA-ADP |
| Oct 22, 2026 | New CVE Received | EEF |