CVE-2026-86696: Unbounded atom creation from unsigned LogoutResponse status codes in esaml allows atom table exhaustion
Allocation of Resources Without Limits or Throttling vulnerability in esaml in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the node via unsigned LogoutResponse messages.
esaml:statuscodemap/1 in src/esaml.erl maps any StatusCode value it does not recognize to an atom with listtoatom/1 on the last colon-separated segment of the URN. esamlsp:validatelogoutresponse/2 verifies a signature only when the message carries one, so an unsigned LogoutResponse posted to the single-logout endpoint reaches esaml:decodelogoutresponse/1 and mints one permanent atom per distinct status value. Atoms are never reclaimed and the VM caps the atom table at about one million entries, so an attacker who posts that many distinct values aborts the node.
This issue affects esaml: from 0.1.0 onward.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to unauthenticated exploitation?
Deployments that expose an esaml single-logout endpoint are exposed because an attacker can post unsigned LogoutResponse messages to that endpoint. The affected behavior is present in esaml versions from 0.1.0 onward.
Does an attacker need a valid signature or account to trigger the crash?
No. Signature verification occurs only when a LogoutResponse includes a signature, so an unsigned message can reach the vulnerable decoding path without authentication.
What input is required to exhaust the atom table?
The attacker must submit many LogoutResponse messages with distinct unrecognized StatusCode values. Each value causes esaml to create a permanent atom from the final colon-separated portion of the status-code URN; around one million distinct atoms can abort the Erlang node.
How can I determine whether a deployment is affected?
Check whether the application uses esaml version 0.1.0 or later and exposes a single-logout endpoint that accepts LogoutResponse messages. The vulnerable path involves esaml:status_code_map/1 and esaml_sp:validate_logout_response/2 processing unsigned responses.