Allocation of Resources Without Limits or Throttling vulnerability in esaml_binding in dropbox esaml allows an unauthenticated attacker to exhaust… (CVE-2026-105270)

The esaml_binding:decode_response/2 function in Dropbox esaml parses decoded SAMLResponse XML using xmerl_scan:string/2, which interns all element names, attribute names, and namespace prefixes as permanent atoms in the Erlang VM. Because these atoms are never reclaimed and the atom table has a fixed maximum size (~1 million entries), an attacker can send a crafted SAMLResponse containing thousands of distinct names to exhaust the atom table. The SAML consume (ACS) and single-logout endpoints process these requests before signature verification, allowing unauthenticated attackers to trigger this resource exhaustion and crash the Erlang node. This vulnerability affects all esaml versions from 0.1.0 onward.

An unauthenticated attacker can cause a denial of service by crashing the Erlang VM node running the vulnerable esaml_binding code. This is achieved by exhausting the atom table through crafted SAMLResponse messages containing many distinct XML names. The crash disrupts service availability until the node is restarted.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider implementing request size limits, input validation, or other protective controls at the network or application layer to mitigate the risk of atom table exhaustion. Monitor for unusual request patterns targeting SAML endpoints.