Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-86696— Unbounded atom creation from unsigned LogoutResponse status codes in esaml allows atom table exhaustion

Quick assessment

Affected
handnot2 esaml
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Dropbox 的 esaml 库存在“无限制或无节流机制的资源分配”漏洞。该漏洞允许未认证的攻击者通过发送未签名的 LogoutResponse 消息，耗尽 Erlang 虚拟机（VM）的原子（atom）表，从而导致节点崩溃。 具体而言， 中的 函数会将任何它无法识别的 StatusCode 值，通过 转换为原子，转换依据是 URN 中最后一个冒号分隔的片段。而 函数仅在消息携带签名时才进行验证。因此，若攻击者向单点注销（single-logout）端点发送未签名的 LogoutResponse，该消息会进入 ，

CVSS 8.2 · High

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-86696

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Unbounded atom creation from unsigned LogoutResponse status codes in esaml allows atom table exhaustion
Source: CVE Program / CVE List V5
Vulnerability Description
Allocation of Resources Without Limits or Throttling vulnerability in esaml in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the node via unsigned LogoutResponse messages. esaml:status_code_map/1 in src/esaml.erl maps any StatusCode value it does not recognize to an atom with list_to_atom/1 on the last colon-separated segment of the URN. esaml_sp:validate_logout_response/2 verifies a signature only when the message carries one, so an unsigned LogoutResponse posted to the single-logout endpoint reaches esaml:decode_logout_response/1 and mints one permanent atom per distinct status value. Atoms are never reclaimed and the VM caps the atom table at about one million entries, so an attacker who posts that many distinct values aborts the node. This issue affects esaml: from 0.1.0 onward.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
不加限制或调节的资源分配
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
handnot2 esaml be692b56245071899757afa7ef47e43593d3de96 ~ * cpe:2.3:a:handnot2:esaml:*:*:*:*:*:*:*:*
arekinath esaml be692b56245071899757afa7ef47e43593d3de96 ~ * cpe:2.3:a:arekinath:esaml:*:*:*:*:*:*:*:*
dropbox esaml 0.1.0 ~ * cpe:2.3:a:dropbox:esaml:*:*:*:*:*:*:*:*
dropbox esaml be692b56245071899757afa7ef47e43593d3de96 ~ * cpe:2.3:a:dropbox:esaml:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-86696

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-86696

请登录查看更多情报信息。

Other References for CVE-2026-86696 (5)

IV. Related Vulnerabilities

Same product: esaml
Same vendor: handnot2
Same weakness: CWE-770

V. Comments for CVE-2026-86696

No comments yet

Leave a comment