Unbounded atom creation while parsing SAML messages in esaml allows atom table exhaustion
CVE-2026-105270 · EEF-CVE-2026-105270 · published 22 Oct 2026
How serious is it
- Severity: high, CVSS score 8.7 out of 10.
- No exploit prediction (EPSS) score yet.
- Not on the CISA list of exploited vulnerabilities.
- No public exploit in Exploit-DB.
Is your app affected by CVE-2026-105270?
Paste this prompt into Claude Code, Cursor or any AI coding tool: it runs a free Shippable scan of your project and fixes what it finds. Built with Lovable, Bolt or v0? Scan your live app. Or upload your package file.
Who is affected
esaml(Hex) >= 0.1.0
How to check
- Look for
esamlin your lockfile and compare its version with the range above. - Or paste your lockfile into the checker: it lists every package with a known vulnerability, this one included.
How to fix
Copies a prompt for Claude Code, Cursor or Codex: it checks your lockfiles for this and upgrades it.
- No fixed version of
esamlyet. Replace or remove it, or apply the workaround in the advisory below. - If a vulnerable version was live, check your logs and rotate the secrets that server could read.
The advisory
Allocation of Resources Without Limits or Throttling vulnerability in esaml_binding in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the node via a crafted SAMLResponse.
esaml_binding:decode_response/2 parses the decoded SAMLResponse with xmerl_scan:string/2, which interns every element name, attribute name, and namespace prefix it reads as a permanent atom. The SAML consume (ACS) and single-logout endpoints call it on unauthenticated requests before any signature check, so one well-formed document with thousands of distinct names mints thousands of atoms while staying inside the 128 KB request body limit. Atoms are never reclaimed and the VM caps the atom table at about one million entries, so a few dozen requests abort the node.
This issue affects esaml: from 0.1.0 onward.
Check your whole app
Dependencies are only half of it. Free and read-only: before you push, run npx shippable-dev scan localhost:3000 in your project folder, no account needed. For your live app, you prove it's yours with a one-line tag first.
References
- cna.erlef.org/cves/CVE-2026-105270.html
- github.com/arekinath/esaml/commit/deeb84378d5c82153b470e99d24f77c38afca14a
- github.com/handnot2/esaml/commit/deeb84378d5c82153b470e99d24f77c38afca14a
- github.com/dropbox/esaml/commit/deeb84378d5c82153b470e99d24f77c38afca14a
- hex.pm/packages/esaml
- osv.dev/vulnerability/EEF-CVE-2026-105270
Merged from OSV, CVE List. Last updated 1 Nov 2026. All vulnerabilities · RSS · JSON