Dropbox esaml EUVD-2026-108035

The target must run a service that uses esaml (0.1.0 or later) and expose its SAML assertion-consumer (ACS) or single-logout (SLO) endpoint, which esaml parses via esaml_binding:decode_response/2 before any signature validation - so no authentication, credentials, or valid SAML trust relationship is required. No non-default configuration is needed beyond having SAML SSO enabled, which is the library's intended use. The practical limiting factor is reach rather than access: exploitation only affects deployments that actually use this specific Erlang library, and the impact is confined to availability (node crash) with no data exposure. An additional amplifying condition is that co-located applications sharing the same Erlang VM would also go down when the node aborts.

This is a genuine but narrowly-scoped availability risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms a remote, low-complexity, unauthenticated trigger with no user interaction, and the impact profile is purely availability (VC:N/VI:N/VA:H) - there is no confidentiality or integrity exposure. The mechanism is credible and well-documented in the advisory and patch commit: esaml_binding:decode_response/2 feeds attacker-controlled XML to xmerl_scan, which interns element/attribute/namespace names as permanent Erlang atoms; because the ACS and single-logout endpoints parse before any signature check, and the atom table is capped near one million entries and never garbage-collected, a few dozen crafted 128 KB requests can abort the entire node. No EPSS score, no CISA KEV listing, and no public proof-of-concept were provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation - exploitation ease is high in principle but opportunistic weaponization is unproven. The dominant factor limiting real-world priority is product reach: esaml is a niche Erlang SAML library, not widely-deployed infrastructure, so despite the 8.7 score this should be treated as a patch-promptly-where-used item rather than an emergency across a broad fleet. Note the full-node crash could affect co-hosted applications sharing the Erlang VM, a scope consideration not captured by the input vector's SC/SI/SA:N.

An attacker identifies a web service using esaml for SAML SSO and locates its assertion-consumer (ACS) or single-logout endpoint, both reachable without authentication. They POST a well-formed SAMLResponse containing thousands of distinct element, attribute, and namespace names while staying under the 128 KB body limit, and repeat it a few dozen times; each unique name is interned as a permanent atom, exhausting the ~1 million-entry atom table and crashing the entire Erlang node. No public exploit code is identified at time of analysis, but the technique is simple and fully described in the advisory.