249 matches found
CVE-2026-86696
Allocation of Resources Without Limits or Throttling vulnerability in esaml in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the node via unsigned LogoutResponse messages. esaml:statuscodemap/1 in src/esaml.erl maps any StatusCode value it does not...
CVE-2026-105270
Allocation of Resources Without Limits or Throttling vulnerability in esamlbinding in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the node via a crafted SAMLResponse. esamlbinding:decoderesponse/2 parses the decoded SAMLResponse with...
CVE-2026-86696 Unbounded atom creation from unsigned LogoutResponse status codes in esaml allows atom table exhaustion
Allocation of Resources Without Limits or Throttling vulnerability in esaml in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the node via unsigned LogoutResponse messages. esaml:statuscodemap/1 in src/esaml.erl maps any StatusCode value it does not...
CVE-2026-86696
The esaml library (version 0.1.0 and onward), used in dropbox esaml , is vulnerable to an Allocation of Resources Without Limits or Throttling (CWE-770) flaw. An unauthenticated attacker can exhaust the Erlang VM atom table and crash the node by sending unsigned LogoutResponse messages to the sin...
EUVD-2026-108051
Allocation of Resources Without Limits or Throttling vulnerability in esaml in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the node via unsigned LogoutResponse messages. esaml:statuscodemap/1 in src/esaml.erl maps any StatusCode value it does not...
EEF-CVE-2026-86696 Unbounded atom creation from unsigned LogoutResponse status codes in esaml allows atom table exhaustion
Summary Allocation of Resources Without Limits or Throttling vulnerability in esaml in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the node via unsigned LogoutResponse messages. esaml:statuscodemap/1 in src/esaml.erl maps any StatusCode value it...
CVE-2026-86696 Unbounded atom creation from unsigned LogoutResponse status codes in esaml allows atom table exhaustion
Allocation of Resources Without Limits or Throttling vulnerability in esaml in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the node via unsigned LogoutResponse messages. esaml:statuscodemap/1 in src/esaml.erl maps any StatusCode value it does not...
CVE-2026-86696
Allocation of Resources Without Limits or Throttling vulnerability in esaml in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the node via unsigned LogoutResponse messages. esaml:statuscodemap/1 in src/esaml.erl maps any StatusCode value it does not...
CVE-2026-105270 Unbounded atom creation while parsing SAML messages in esaml allows atom table exhaustion
Allocation of Resources Without Limits or Throttling vulnerability in esamlbinding in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the node via a crafted SAMLResponse. esamlbinding:decoderesponse/2 parses the decoded SAMLResponse with...
CVE-2026-105270
The dropbox esaml library (version 0.1.0 and onward) is vulnerable to an Allocation of Resources Without Limits or Throttling vulnerability in the esaml_binding component. The esaml_binding:decode_response/2 function uses xmerl_scan:string/2 to parse SAMLResponse data, which interns every element...
CVE-2026-105270 Unbounded atom creation while parsing SAML messages in esaml allows atom table exhaustion
Allocation of Resources Without Limits or Throttling vulnerability in esamlbinding in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the node via a crafted SAMLResponse. esamlbinding:decoderesponse/2 parses the decoded SAMLResponse with...
EUVD-2026-108035
Allocation of Resources Without Limits or Throttling vulnerability in esamlbinding in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the node via a crafted SAMLResponse. esamlbinding:decoderesponse/2 parses the decoded SAMLResponse with...
EEF-CVE-2026-105270 Unbounded atom creation while parsing SAML messages in esaml allows atom table exhaustion
Summary Allocation of Resources Without Limits or Throttling vulnerability in esamlbinding in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the node via a crafted SAMLResponse. esamlbinding:decoderesponse/2 parses the decoded SAMLResponse with...
CVE-2026-105270
Allocation of Resources Without Limits or Throttling vulnerability in esamlbinding in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the node via a crafted SAMLResponse. esamlbinding:decoderesponse/2 parses the decoded SAMLResponse with...
PT-2026-121295
Allocation of Resources Without Limits or Throttling vulnerability in esaml in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the node via unsigned LogoutResponse messages. esaml:status code map/1 in src/esaml.erl maps any StatusCode value it does n...
PT-2026-121279
Allocation of Resources Without Limits or Throttling vulnerability in esaml binding in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the node via a crafted SAMLResponse. esaml binding:decode response/2 parses the decoded SAMLResponse with xmerl...
Lexi Wilson exposed a resource management error vulnerability
Lexi Wilson has identified a resource management error vulnerability in versions 0.1.0 and later of esaml. This vulnerability arises because when esamlbinding:decoderesponse/2 uses xmerlscan:string/2 to parse SAML Responses, it registers element names, attribute names, and namespace prefixes as...
CVE-2026-67226
A flaw was found in rabbitmq-server. An authenticated user with administrative privileges can cause a Denial of Service DoS by submitting user definitions containing an excessive number of unique tag names. Because the application converts each tag string into an internal Erlang identifier that...
CVE-2026-66073
A flaw was found in rabbitmq-server. An authenticated user with management API access can cause a Denial of Service DoS by sending requests containing arbitrary node names to queue, exchange, or binding endpoints. Because untrusted input is converted into internal system identifiers atoms without...
CVE-2026-94201
Ash stores :atom-typed attributes as strings and compares them as strings. When such an attribute is referenced in a filter, the comparison value is coerced through Ash.Type.Atom. Because the type defined no coerce/2 callback, coercion fell back to the default castinput/2, which calls...