esaml EUVD-2026-108051

Exploitation requires the target to deploy esaml as a SAML Service Provider with a reachable single-logout (SLO) endpoint (e.g. the esaml_cowboy validate_logout handler) that routes LogoutResponse messages into esaml_sp:validate_logout_response/2 and esaml:decode_logout_response/1. The key enabling condition is that signature verification is NOT enforced on unsigned LogoutResponse messages, so the attacker does not need any valid IdP signature or credentials; messages with attacker-chosen, previously-unseen StatusCode URN values each create a new permanent atom via list_to_atom/1. The principal LIMITING factor is volume and time: the Erlang VM default atom-table ceiling (~1,048,576 entries) means the attacker must send on the order of a million requests with distinct status values to reach node abort (reflected as AT:P), and sites that raise/lower +t or front the SLO endpoint with rate limiting or WAF controls raise the bar further. Any esaml version from 0.1.0 up to the fix commit be692b5 on an affected fork is in scope.

This is a pure availability (denial-of-service) issue: the CNA-supplied CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N, base 8.2) shows network reach and no privileges/interaction (PR:N/UI:N), but critically carries AT:P - an attack requirement - and VC:N/VI:N with only VA:H, confirming no confidentiality or integrity exposure. The AT:P is the decisive signal: the Erlang VM atom table caps near ~1,048,576 entries, so the attacker must post on the order of one million distinct unsigned LogoutResponse status values before the node aborts, making this a volumetric effort rather than a single-shot crash. No EPSS score, CISA KEV entry, or public exploit was provided in the input, so exploitation status is 'no public exploit identified at time of analysis' and there is no evidence of active or opportunistic mass exploitation. Net: the 8.2 is legitimate for an unauthenticated network DoS, but it is availability-only against a niche Erlang SAML library and requires sustained high request volume, so it is a real but second-tier priority - patch promptly where esaml acts as an SP, but it is not a drop-everything confidentiality/RCE emergency. Note the CVSS is 4.0 only; no 3.1 vector or EPSS was supplied, so cross-signal comparison is limited to vector-plus-description reasoning.

An unauthenticated attacker locates an internet-reachable SAML single-logout (SLO) endpoint served by an esaml-based Service Provider and repeatedly posts unsigned LogoutResponse messages, each carrying a different unrecognized StatusCode URN. Because validate_logout_response/2 only verifies a signature when one is present, each message reaches decode_logout_response/1 where status_code_map/1 calls list_to_atom/1 on a fresh URN segment, minting a permanent atom; after roughly a million distinct values the atom table fills and the Erlang node crashes. No public exploit code is identified at time of analysis, but the attack is scriptable and requires no special tooling.