An unbounded allocation of resources occurs when the esaml_binding component parses SAMLResponse messages. Each XML element, attribute, and namespace prefix is interned as an Erlang atom, a permanent entry in the VM atom table that cannot be reclaimed. A crafted message that contains thousands of unique names can consume a substantial portion of the atom table. Because the sys limits the atom table to about one million entries, only a few dozen such requests are sufficient to exhaust the table and crash the node. The attack can be launched on an unauthenticated request to SAML consume (ACS) or single‑logout endpoints, before any signature or authentication checks occur.

The issue affects the esaml library, used by vendors such as arekinath, dropbox, and handnot2. It is present in all released versions from 0.1.0 onward. The vulnerability is triggered by any instance of esaml that processes incoming SAMLResponse data through decode_response/2.

The CVSS score of 8.7 marks this vulnerability as high severity. No EPSS value is available, and it is not listed in CISA KEV, indicating that a public exploitation vector has not yet been observed. However, the lack of authentication or signature validation on the vulnerable endpoints makes the attack straightforward for an unauthenticated adversary who can send a crafted SAMLResponse. The vulnerability would cause an immediate denial of service by terminating the Erlang VM, potentially affecting all services running on the same node. The attack does not require privileged access or complex preparation, and the short response payload limit (128 KB) does not mitigate the problem.