CVE-2026-105270: Dropbox esaml: Atom table exhaustion via crafted SAML messages

Summary

The esaml Erlang SAML library creates permanent atoms for every distinct element, attribute and namespace name in an incoming SAMLResponse before any signature check. The SAML consume (ACS) and single-logout endpoints accept this input from unauthenticated users. A few dozen small requests can exhaust the Erlang atom table and crash the node, causing a denial of service for the affected service provider.

Affected

dropbox esaml from 0.1.0 onward (per CNA record)
Git versions from commit deeb84378d5c82153b470e99d24f77c38afca14a onward (arekinath, handnot2 and dropbox forks)
Hex package esaml 0.1.0 and later (per CNA record)

Fixed in

Unknown. No fixed release has been identified in the sources. Check commit deeb84378d5c82153b470e99d24f77c38afca14a and the Hex release notes.

Workaround

No vendor workaround found.
Rate-limit or WAF-filter requests to the ACS and logout paths, while keeping them reachable for the identity provider.
Monitor the Erlang atom count and alert on unexpected node restarts.

Exploitation

CISA SSVC: exploitation status PoC, automatable: yes, technical impact: partial.
No public proof of concept found in the research; not on the known-exploited list.

Our recommendation

Check whether any Erlang or Elixir application embeds esaml or samly (inspect lock files).
If present, ask the application vendor for a patched version and a patch date.
Apply the monitoring and rate-limiting measures above until a fix is installed.
If no fix exists, plan migration to a maintained SAML library.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

CNA record CVE-2026-105270 cna.erlef.org
Commit deeb843 in dropbox/esaml github.com
OSV record EEF-CVE-2026-105270 osv.dev
Hex package esaml hex.pm
Hex package esaml versions hex.pm
VulDB entry 425200 vuldb.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 00:55.

Original description (NVD)

Allocation of Resources Without Limits or Throttling vulnerability in esaml_binding in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the node via a crafted SAMLResponse. esaml_binding:decode_response/2 parses the decoded SAMLResponse with xmerl_scan:string/2, which interns every element name, attribute name, and namespace prefix it reads as a permanent atom. The SAML consume (ACS) and single-logout endpoints call it on unauthenticated requests before any signature check, so one well-formed document with thousands of distinct names mints thousands of atoms while staying inside the 128 KB request body limit. Atoms are never reclaimed and the VM caps the atom table at about one million entries, so a few dozen requests abort the node. This issue affects esaml: from 0.1.0 onward.

NVD references (6)

Sources

The tracker combines official, freely usable data sources – updated continuously:

NVD (NIST) – CVEs, rating (CVSS), affected products
CISA KEV – vulnerabilities confirmed by CISA as actively exploited
CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
FIRST EPSS – probability of exploitation
Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
PoC-in-GitHub – public proof-of-concept repositories
Metasploit (Rapid7) – modules of the Metasploit Framework
Exploit-DB (OffSec) – archive of public exploits (links only)
Patch days: official vendor pages (linked per vendor) (Vendor patch days)

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touch RSS feed