The vulnerability is a resource exhaustion flaw in the esaml library, where an unauthenticated attacker can send LogoutResponse messages without a signature to the single‑logout endpoint. The library maps any unknown StatusCode to a new atom derived from the URN. Each distinct unsigned status creates a permanent atom, and atoms are never garbage‑collected. When about one million unique atoms are created, the Erlang VM atom table overflows and the node crashes, resulting in a denial of service. This flaw falls under CWE‑770.

The affected product is esaml, maintained by arekinath, dropbox, and handnot2, from version 0.1.0 onward. Any release of esaml that has not applied the fix for the atom‑creation issue is vulnerable. The vulnerability is present in all distributions that include the esaml source code used by those vendors.

The CVSS score of 8.2 indicates a high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but the attack is straightforward: an unauthenticated attacker can craft a LogoutResponse message with an arbitrary StatusCode and post it to the single‑logout endpoint. Because the library does not enforce signature verification for unsigned messages, the attacker can trigger the atom table exhaustion without authentication or special privileges. Successful exploitation will lead to a crash of the node and denial of service for all users.