Resource Exhaustion Vulnerability in Dropbox's esaml Product
CVE-2026-105270

8.7HIGH

Key Information:

Vendor

Arekinath

Status
Esaml
Vendor
CVE Published:
22 October 2026

What is CVE-2026-105270?

A resource exhaustion vulnerability exists in the SAML binding component of Dropbox's esaml, enabling an unauthenticated attacker to exploit the system by submitting a crafted SAMLResponse. This attack can potentially exhaust the Erlang VM atom table, leading to node crashes. The vulnerability arises from the handling of SAMLResponses, where the decoding process allows for the creation of numerous permanent atoms without proper limits or throttling. As the atom table is capped, a limited number of requests can cause the node to become unstable, posing a significant risk to system availability.

Affected Version(s)

esaml deeb84378d5c82153b470e99d24f77c38afca14a

esaml deeb84378d5c82153b470e99d24f77c38afca14a

esaml 0.1.0

References

https://cna.erlef.org/cves/CVE-2026-105270.html
relatedthird-party-advisory
https://osv.dev/vulnerability/EEF-CVE-2026-105270
related
https://github.com/arekinath/esaml/commit/deeb84378d5c821...
related

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Quinn Wilton
Quinn Wilton
Jonatan Männchen / EEF
.