Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-105270— Unbounded atom creation while parsing SAML messages in esaml allows atom table exhaustion

Quick assessment

Affected
arekinath esaml
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Dropbox 的 esaml 库中 esaml_binding 模块存在“无限制或无节流机制的资源分配”漏洞。该漏洞允许未认证的攻击者通过构造恶意的 SAMLResponse 耗尽 Erlang 虚拟机（VM）的原子表（atom table），从而导致节点崩溃。 具体而言，esaml_binding:decode_response/2 函数使用 xmerl_scan:string/2 解析已解码的 SAMLResponse，该函数会将读取到的每个元素名、属性名和命名空间前缀永久注册为原子（intern as pe

CVSS 8.7 · High

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-105270

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Unbounded atom creation while parsing SAML messages in esaml allows atom table exhaustion
Source: CVE Program / CVE List V5
Vulnerability Description
Allocation of Resources Without Limits or Throttling vulnerability in esaml_binding in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the node via a crafted SAMLResponse. esaml_binding:decode_response/2 parses the decoded SAMLResponse with xmerl_scan:string/2, which interns every element name, attribute name, and namespace prefix it reads as a permanent atom. The SAML consume (ACS) and single-logout endpoints call it on unauthenticated requests before any signature check, so one well-formed document with thousands of distinct names mints thousands of atoms while staying inside the 128 KB request body limit. Atoms are never reclaimed and the VM caps the atom table at about one million entries, so a few dozen requests abort the node. This issue affects esaml: from 0.1.0 onward.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
不加限制或调节的资源分配
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
arekinath esaml deeb84378d5c82153b470e99d24f77c38afca14a ~ * cpe:2.3:a:arekinath:esaml:*:*:*:*:*:*:*:*
handnot2 esaml deeb84378d5c82153b470e99d24f77c38afca14a ~ * cpe:2.3:a:handnot2:esaml:*:*:*:*:*:*:*:*
dropbox esaml 0.1.0 ~ * cpe:2.3:a:dropbox:esaml:*:*:*:*:*:*:*:*
dropbox esaml deeb84378d5c82153b470e99d24f77c38afca14a ~ * cpe:2.3:a:dropbox:esaml:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-105270

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-105270

请登录查看更多情报信息。

Other References for CVE-2026-105270 (5)

IV. Related Vulnerabilities

Same product: esaml
Same weakness: CWE-770

V. Comments for CVE-2026-105270

No comments yet

Leave a comment