esaml: Unbounded atom creation via unsigned LogoutResponse leads to node crash
Summary
The Erlang SAML library esaml creates a new atom for every distinct, unrecognized StatusCode value in an unsigned SAML LogoutResponse sent to the single-logout endpoint. Erlang atoms are never reclaimed, so an unauthenticated attacker who sends about one million distinct values can exhaust the atom table and crash the Erlang VM. This affects the single-logout path of applications that use esaml from version 0.1.0 onward, while the assertion consumer path is not affected.
Affected
- esaml from 0.1.0 onward (Hex package)
- Git-based versions from commit be692b5 onward (dropbox, arekinath and handnot2 repositories)
- Downstream applications that expose the single-logout endpoint, e.g. via esaml_cowboy:validate_logout/2
Fixed in
- Fix commit: be692b56245071899757afa7ef47e43593d3de96 (upstream esaml repositories)
- Fixed release: Unknown. No released version containing the fix has been confirmed.
Workaround
- No vendor workaround published.
- Disable the single-logout endpoint if the identity provider does not require it.
- If SLO is required, restrict the endpoint at the reverse proxy or WAF to the identity provider's addresses and apply rate limiting.
- Monitor the BEAM atom count to detect growth early. Raising the atom limit only delays exhaustion.
Exploitation
- No evidence of exploitation in the wild known.
- No public proof of concept found.
- CISA SSVC assessment: exploitation PoC, not automatable, partial technical impact.
Our recommendation
- Check whether your application uses esaml and exposes a single-logout endpoint.
- If affected, apply commit be692b5 to your own copy and test it in a non-production environment, as no fixed release is confirmed.
- Apply the same review to related CVE-2026-105270 (SAMLResponse path), which has no confirmed fix either.
- Restrict or disable the SLO endpoint until a fix is in place, and monitor the node for atom growth and restarts.
- Note that the upstream project is poorly maintained, so plan for a self-maintained patch.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE record (CNA EEF) cna.erlef.org
- OSV record EEF-CVE-2026-86696 osv.dev
- Fix commit be692b5 (dropbox/esaml) github.com
- Fix commit be692b5 (arekinath/esaml) github.com
- VulDB CVE-2026-86696 vuldb.com
- CVE-2026-105270 (related) vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 15:13.
Original description (NVD)
Allocation of Resources Without Limits or Throttling vulnerability in esaml in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the node via unsigned LogoutResponse messages. esaml:status_code_map/1 in src/esaml.erl maps any StatusCode value it does not recognize to an atom with list_to_atom/1 on the last colon-separated segment of the URN. esaml_sp:validate_logout_response/2 verifies a signature only when the message carries one, so an unsigned LogoutResponse posted to the single-logout endpoint reaches esaml:decode_logout_response/1 and mints one permanent atom per distinct status value. Atoms are never reclaimed and the VM caps the atom table at about one million entries, so an attacker who posts that many distinct values aborts the node. This issue affects esaml: from 0.1.0 onward.
NVD references (7)
- https://cna.erlef.org/cves/CVE-2026-86696.html
- https://github.com/arekinath/esaml/commit/be692b56245071899757afa7ef47e43593d3de96
- https://github.com/dropbox/esaml/commit/be692b56245071899757afa7ef47e43593d3de96
- https://github.com/handnot2/esaml/commit/be692b56245071899757afa7ef47e43593d3de96
- https://osv.dev/vulnerability/EEF-CVE-2026-86696
- https://cna.erlef.org/cves/CVE-2026-86696.html
- https://osv.dev/vulnerability/EEF-CVE-2026-86696
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.