CVE-2026-105270 Dropbox CVE debrief

Who should care

Defenders responsible for esaml deployments, particularly those using affected versions, should assess exposure and prioritize remediation to prevent potential denial-of-service attacks.

Why it matters

CVE-2026-105270 is a high-severity vulnerability in esaml that allows unauthenticated attackers to crash nodes via crafted SAML responses. Defenders should prioritize verifying affected versions, assessing exposure, and applying remediation to prevent potential denial-of-service attacks.

• Potential denial-of-service attacks via crafted SAML responses
• Node crashes due to atom table exhaustion
• Verification of affected versions and exposure is necessary
• Remediation priority to prevent potential attacks

Technical summary

The esaml_binding:decode_response/2 function in dropbox esaml parses SAMLResponse with xmerl_scan:string/2, which interns every element name, attribute name, and namespace prefix as a permanent atom. This can lead to atom table exhaustion and node crashes when processing crafted SAML responses. The vulnerability affects esaml versions from 0.1.0 onward. Defenders should prioritize verifying affected versions, assessing exposure, and applying remediation to prevent potential denial-of-service attacks. The CVE record provides details on the vulnerability, including its description and references.

Defensive priority

Defenders should prioritize verifying affected versions, assessing exposure, and applying remediation to prevent potential denial-of-service attacks.

Recommended defensive actions

• Verify affected versions of esaml and assess exposure
• Apply remediation to prevent potential denial-of-service attacks
• Monitor for suspicious SAML responses
• Implement compensating controls to limit potential impact
• Review relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and references. Evidence is limited to public CVE Program records and supplemental source references. Defenders should verify affected esaml versions, assess exposure, and apply remediation to prevent potential denial-of-service attacks. The CVE record was published on 2026-10-22T06:58:43.034Z and has not been modified since then. No additional evidence or claims are provided.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.