CVE-2026-86696

Name of the Vulnerable Software and Affected Versions esaml versions 0.1.0 and later

Description An unauthenticated attacker can cause a denial of service by exhausting the Erlang VM atom table, leading to a node crash. This occurs when unsigned LogoutResponse messages are sent to the single-logout endpoint. The function esaml:status code map/1 in src/esaml.erl uses list to atom/1 to convert unrecognized StatusCode values from the URN into atoms. Because esaml sp:validate logout response/2 only verifies signatures if they are present, unsigned messages reach esaml:decode logout response/1 and create permanent atoms for each distinct status value. Since atoms are not reclaimed and the VM has a limit of approximately one million entries, sending a large number of unique values will abort the node.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.