CVE-2026-86696 Details
Description
Allocation of Resources Without Limits or Throttling vulnerability in esaml in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the node via unsigned LogoutResponse messages. esaml:status_code_map/1 in src/esaml.erl maps any StatusCode value it does not recognize to an atom with list_to_atom/1 on the last colon-separated segment of the URN. esaml_sp:validate_logout_response/2 verifies a signature only when the message carries one, so an unsigned LogoutResponse posted to the single-logout endpoint reaches esaml:decode_logout_response/1 and mints one permanent atom per distinct status value. Atoms are never reclaimed and the VM caps the atom table at about one million entries, so an attacker who posts that many distinct values aborts the node. This issue affects esaml: from 0.1.0 onward.
A resource exhaustion vulnerability has been identified in the Dropbox esaml library, specifically in versions 0.1.0 and later. This vulnerability allows an unauthenticated attacker to send unsigned LogoutResponse messages, which are then processed in a way that exhausts the Erlang VM atom table. The issue arises because the esaml:status_code_map/1 function converts unrecognized StatusCode values into atoms using list_to_atom/1, creating a permanent entry for each distinct value. Since the atom table has a limit of approximately one million entries, an attacker can crash the node by sending enough unique status values. The vulnerability is reachable when the service provider's single-logout endpoint is used, as this endpoint does not require a signature for LogoutResponse messages and directly maps status codes to atoms,
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 22, 2026CISA-ADP
Assessed Oct 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cna.erlef.org/cves/CVE-2026-86696.html | CISA-ADP | AdvisoryExploit |
| https://osv.dev/vulnerability/EEF-CVE-2026-86696 | CISA-ADP | AdvisoryExploit |
| https://cna.erlef.org/cves/CVE-2026-86696.html | EEF | AdvisoryExploit |
| https://github.com/arekinath/esaml/commit/be692b56245071899757afa7ef47e43593d3de96 | EEF | Source CodeVendor |
| https://github.com/dropbox/esaml/commit/be692b56245071899757afa7ef47e43593d3de96 | EEF | Broken LinkSource CodeVendor |
| https://github.com/handnot2/esaml/commit/be692b56245071899757afa7ef47e43593d3de96 | EEF | Source CodeVendor |
| https://osv.dev/vulnerability/EEF-CVE-2026-86696 | EEF | AdvisoryExploit |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling | EEF |
Affected Products
| Product | Versions |
|---|---|
| handnot2 esaml | >= be692b5 |
CPE
Remediation
| |
| arekinath esaml | >= be692b5 |
CPE
Remediation
| |
| dropbox esaml | >= 0.1.0 (semver) >= be692b5 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 30, 2026 | CVE Modified | CISA-ADP |
| Oct 22, 2026 | New CVE Received | EEF |