CVE-2026-105270: esaml 0.1.0 to before *

Affected technology

esaml · deeb84378d5c82153b470e99d24f77c38afca14a to before *
arekinath

esaml · 0.1.0 to before *
dropbox

Component: esaml_binding, esaml_cowboy
Function: esaml_binding:decode_response/2, esaml_cowboy:validate_assertion/2, esaml_cowboy:validate_logout/2
File: src/esaml_binding.erl, src/esaml_cowboy.erl

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

An unauthenticated attacker can exhaust the Erlang VM atom table and crash the node via a crafted SAMLResponse. esaml_binding:decode_response/2 parses the decoded SAMLResponse with xmerl_scan:string/2, which interns every element name, attribute name, and namespace prefix it reads as a permanent atom. Source advisory’s CVSS 4.0 assessment (base score 8.7/10) rates confidentiality and integrity impact as none; availability impact as high.