Resource Exhaustion Vulnerability in Dropbox esaml Product
CVE-2026-86696

8.2HIGH

Key Information:

Vendor

Handnot2

Status
Esaml
Vendor
CVE Published:
22 October 2026

What is CVE-2026-86696?

The vulnerability in Dropbox's esaml product allows unauthenticated attackers to exploit the system through unsigned LogoutResponse messages. This exploit involves manipulating the atom table of the Erlang VM, leading to resource exhaustion and potential node crashes. By posting a multitude of distinct status values, an attacker can create permanent atoms, which are never reclaimed, causing the atom table to reach its limit of approximately one million entries. As a result, the system may become unresponsive or crash, disrupting services and impacting users.

Affected Version(s)

esaml be692b56245071899757afa7ef47e43593d3de96

esaml be692b56245071899757afa7ef47e43593d3de96

esaml 0.1.0

References

https://cna.erlef.org/cves/CVE-2026-86696.html
relatedthird-party-advisory
https://osv.dev/vulnerability/EEF-CVE-2026-86696
related
https://github.com/handnot2/esaml/commit/be692b5624507189...
related

CVSS V4

Score:
8.2
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Quinn Wilton
Quinn Wilton
Jonatan Männchen / EEF
.