CVE-2026-86696: esaml Package Atom Table Exhaustion via Unsigned LogoutResponse
Summary
CVE-2026-86696: Unbounded atom creation from unsigned LogoutResponse status codes in esaml allows atom table exhaustion. Affects esaml across 2 version ranges.
>= 0.1.0
>= be692b56245071899757afa7ef47e43593d3de96
No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The esaml package is an implementation of SAML (Security Assertion Markup Language) for Erlang, primarily used for handling authentication and authorization in web applications. It facilitates secure communication between service providers and identity providers. However, the package is vulnerable to a specific attack that allows unauthenticated users to exploit the LogoutResponse functionality, leading to potential denial of service.
Vulnerability Detail
The vulnerability arises from the lack of signature verification for LogoutResponse messages in the esaml package. An attacker can send unsigned LogoutResponse messages with unique status codes, which are converted into permanent atoms in the Erlang VM. As the atom table has a limit of approximately one million entries, an attacker can exhaust this limit, causing the Erlang VM to crash and deny service to all users. This issue affects all versions of esaml from 0.1.0 onward.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can implement input validation on the LogoutResponse messages to reject any unsigned messages or limit the number of distinct status codes that can be processed. This can help mitigate the risk of atom table exhaustion until a patch is applied.
Conclusion
CVE-2026-86696 is a significant vulnerability in the esaml package that can lead to denial of service through atom table exhaustion. It is crucial to update the package to the latest version and implement workarounds to protect your application from potential attacks.
See every vulnerability recorded for esaml →
FAQ
CVE-2026-86696 is a vulnerability in the esaml package that allows an attacker to exhaust the Erlang VM atom table by sending unsigned LogoutResponse messages.
If your application uses the esaml package and exposes a single-logout endpoint, it may be susceptible to denial of service attacks due to this vulnerability.
The CVSS score of this vulnerability is 8.2, indicating a high severity level.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability.
Yes, a patched version of the esaml package is available. You should update to the latest version to mitigate this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for esaml.
