CVE-2026-105270 json
Unbounded atom creation while parsing SAML messages in esaml allows atom table exhaustion
published 2026-10-22 17 d ago modified 2026-10-30 9 d ago also EEF-CVE-2026-105270 , EUVD-2026-108035
- cvss
- 8.7
- version 4.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 45%
- public exploits
- 0
- none known
Summary
Allocation of Resources Without Limits or Throttling vulnerability in esaml_binding in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the node via a crafted SAMLResponse.
esaml_binding:decode_response/2 parses the decoded SAMLResponse with xmerl_scan:string/2, which interns every element name, attribute name, and namespace prefix it reads as a permanent atom. The SAML consume (ACS) and single-logout endpoints call it on unauthenticated requests before any signature check, so one well-formed document with thousands of distinct names mints thousands of atoms while staying inside the 128 KB request body limit. Atoms are never reclaimed and the VM caps the atom table at about one million entries, so a few dozen requests abort the node.
This issue affects esaml: from 0.1.0 onward.
Patch / fix
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 9 d ago
Exploit prediction
0.53% chance of exploitation in the next 30 days, higher than 45% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- osv.dev https://osv.dev/vulnerability/EEF-CVE-2026-105270 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
| CNA | 4.0 | 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| hex | esaml | >=0.1.0 |
no fix listed |
Affected products
- arekinath esaml
- handnot2 esaml
- dropbox esaml
Classification
- Weakness
-
- CWE-770 Allocation of Resources Without Limits or Throttling
References
-
github.com
/arekinath/esaml/commit/deeb84378d5c82153b470e99d24f77c38afca14a
related, web
-
github.com
/handnot2/esaml/commit/deeb84378d5c82153b470e99d24f77c38afca14a
related, web
-
github.com
/dropbox/esaml/commit/deeb84378d5c82153b470e99d24f77c38afca14a
related, broken-link, web
-
osv.dev
/vulnerability/EEF-CVE-2026-105270
related, exploit
-
cna.erlef.org
/cves/CVE-2026-105270.html
related, third-party-advisory, web
-
hex.pm
/packages/esaml
package
Sources
- CVE List CVE-2026-105270
- NVD CVE-2026-105270
- OSV EEF-CVE-2026-105270
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.