Allocation of Resources Without Limits or Throttling vulnerability in esaml in dropbox esaml allows an unauthenticated attacker to exhaust the… (CVE-2026-86696)

The esaml library in Dropbox contains an Allocation of Resources Without Limits or Throttling vulnerability (CVE-2026-86696) that allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the node. The issue occurs because esaml:status_code_map/1 converts any unrecognized StatusCode value into a permanent atom using list_to_atom/1 on the last segment of the URN. Since atoms are never garbage collected and the atom table has a fixed size limit (~1 million entries), an attacker can send many distinct unsigned LogoutResponse messages to mint a large number of atoms, causing the node to abort. Signature verification is only performed if a signature is present, so unsigned messages bypass this check. This vulnerability affects all esaml versions starting from 0.1.0.

An unauthenticated attacker can cause a denial of service by crashing the Erlang VM node hosting esaml through exhaustion of the atom table. This results in service disruption until the node is restarted. There is no indication of code execution or data compromise from the provided information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider implementing input validation or filtering to block unsigned LogoutResponse messages with unrecognized status codes or rate-limit such requests to prevent atom table exhaustion. Monitor for unusual traffic patterns targeting the single-logout endpoint.