CVE-2026-86696 dropbox CVE debrief

Who should care

Defenders responsible for systems using esaml, especially those in environments where SAML authentication is used, should assess their exposure and take necessary actions to mitigate this vulnerability.

Why it matters

CVE-2026-86696 is an Allocation of Resources Without Limits or Throttling vulnerability in esaml that allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the node via unsigned LogoutResponse messages. Defenders should prioritize verifying exposure, assessing impact, and implementing compensating controls to mitigate this vulnerability.

• Potential denial-of-service (DoS) attack through atom table exhaustion.
• Unauthenticated attackers can exploit this vulnerability.
• Erlang VM atom table exhaustion can lead to node crashes.
• Verification of exposure and impact is necessary for affected systems.

Technical summary

The esaml library, used for SAML authentication, has a vulnerability that allows an unauthenticated attacker to create an arbitrary number of atoms, leading to a potential denial-of-service (DoS) attack. This is achieved by sending unsigned LogoutResponse messages with distinct status values, which are then converted to atoms, exhausting the Erlang VM's atom table. The vulnerability affects esaml from version 0.1.0 onward. Defenders should prioritize verifying exposure and assessing the impact of this vulnerability on their systems, especially those using esaml.

Defensive priority

Defenders should prioritize verifying exposure and assessing the impact of this vulnerability on their systems, especially those using esaml from version 0.1.0 onward.

Recommended defensive actions

• Verify the version of esaml used in your system and check if it's within the affected range.
• Assess the exposure of your system to unsigned LogoutResponse messages.
• Consider implementing compensating controls to mitigate the impact of this vulnerability.
• Monitor your system's Erlang VM atom table usage and node performance.
• Review relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and references to related sources. The vulnerability allows an unauthenticated attacker to create an arbitrary number of atoms, leading to a potential denial-of-service (DoS) attack. The Erlang VM atom table exhaustion can lead to node crashes. Defenders should verify exposure, assess impact, and implement compensating controls to mitigate this vulnerability. The source item and CVE record provide evidence of the affected

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.