Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.3
CVE-2026-55734: ueberauth/guardian can crash server by exhausting atom table
CVE-2026-55734 · published 3 months ago
Summary
The Guardian library used for authentication can run out of internal identifiers if it receives a specially crafted permissions list. An attacker who can influence that list could cause the server process to stop, affecting all applications on it. Update to the latest version of ueberauth/guardian or apply the vendor's fix to limit or validate incoming permission keys.
What to do
- Update ueberauth guardian to version 2.4.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | ueberauth | guardian |
< 2.4.1 < 8d4efbfc352d30f5fcfc75a4d69a795b0e472724 >= 2.0.0, < 2.4.1 |
| Hex | ueberauth | guardian |
>= 2.0.0, < 2.4.1 Fix: upgrade to 2.4.1
|
Original advisory text
guardian atom exhaustion in Guardian.Permissions.encode_permissions!/1
Allocation of Resources Without Limits or Throttling vulnerability in ueberauth guardian (Guardian.Permissions module) allows a denial of service via BEAM atom-table exhaustion.
This vulnerability is associated with program file lib/guardian/permissions.ex and program routines 'Elixir.Guardian.Permissions':encode_permissions!/1, 'Elixir.Guardian.Permissions':encode_permissions_into_claims!/2, 'Elixir.Guardian.Permissions':do_encode_permissions!/2.
The Guardian.Permissions mixin installs a public encode_permissions!/1 function on every module that does use Guardian.Permissions. For each key of the supplied map, encode_permissions!/1 calls String.to_atom(to_string(k)) before any validation runs. The integer-value clause of do_encode_permissions!/2 then short-circuits straight to encoding without validating the key against the configured permission set, so a key with an integer value is interned as a fresh atom with no exception raised. Atoms are never garbage collected and the BEAM atom table is a fixed-size resource (default roughly 1,048,576 entries), so each unique attacker-chosen key permanently consumes one slot. An attacker who can influence a permission map that reaches encode_permissions!/1 (for example a permissions map read from a request body and passed into token issuance via encode_permissions_into_claims!/2) can mint an unbounded number of atoms and exhaust the atom table, crashing the entire BEAM node and every service running on it. The sibling decode_permissions/1 is not affected because it skips keys absent from the configured permission set.
This issue affects guardian: from 2.0.0 before 2.4.1.
This vulnerability is associated with program file lib/guardian/permissions.ex and program routines 'Elixir.Guardian.Permissions':encode_permissions!/1, 'Elixir.Guardian.Permissions':encode_permissions_into_claims!/2, 'Elixir.Guardian.Permissions':do_encode_permissions!/2.
The Guardian.Permissions mixin installs a public encode_permissions!/1 function on every module that does use Guardian.Permissions. For each key of the supplied map, encode_permissions!/1 calls String.to_atom(to_string(k)) before any validation runs. The integer-value clause of do_encode_permissions!/2 then short-circuits straight to encoding without validating the key against the configured permission set, so a key with an integer value is interned as a fresh atom with no exception raised. Atoms are never garbage collected and the BEAM atom table is a fixed-size resource (default roughly 1,048,576 entries), so each unique attacker-chosen key permanently consumes one slot. An attacker who can influence a permission map that reaches encode_permissions!/1 (for example a permissions map read from a request body and passed into token issuance via encode_permissions_into_claims!/2) can mint an unbounded number of atoms and exhaust the atom table, crashing the entire BEAM node and every service running on it. The sibling decode_permissions/1 is not affected because it skips keys absent from the configured permission set.
This issue affects guardian: from 2.0.0 before 2.4.1.
References
- https://github.com/ueberauth/guardian Product
- https://cna.erlef.org/cves/CVE-2026-55734.html URL
- https://osv.dev/vulnerability/EEF-CVE-2026-55734 URL
- https://github.com/ueberauth/guardian/commit/8d4efbfc352d30f5fcfc75a4d69a795b0e4... Patch
- https://hex.pm/packages/guardian Product
- https://github.com URL
- https://repo.hex.pm URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55734... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-55734 Vendor Advisory
- https://github.com/ueberauth/guardian/security/advisories/GHSA-9qx2-v587-q3gg Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
7.3
High
Type
CWE-770Allocation of Resources Without Limits
Timeline
Published1 Aug 2026
Updated4 Nov 2026
First seen1 Aug 2026
Sources
EEF-CVE-2026-55734 · OSV
GHSA-9qx2-v587-q3gg · GHSA
CVE-2026-55734 · NVD
CVE-2026-55734 · MITRE
CVE-2026-55734 · OSV
Track software like this
Free during beta