CVE-2026-55734 in Guardian
Summary
by MITRE • 08/01/2026
Allocation of Resources Without Limits or Throttling vulnerability in ueberauth guardian (Guardian.Permissions module) allows a denial of service via BEAM atom-table exhaustion.
This vulnerability is associated with program file lib/guardian/permissions.ex and program routines 'Elixir.Guardian.Permissions':encode_permissions!/1, 'Elixir.Guardian.Permissions':encode_permissions_into_claims!/2, 'Elixir.Guardian.Permissions':do_encode_permissions!/2.
The Guardian.Permissions mixin installs a public encode_permissions!/1 function on every module that does use Guardian.Permissions. For each key of the supplied map, encode_permissions!/1 calls String.to_atom(to_string(k)) before any validation runs. The integer-value clause of do_encode_permissions!/2 then short-circuits straight to encoding without validating the key against the configured permission set, so a key with an integer value is interned as a fresh atom with no exception raised. Atoms are never garbage collected and the BEAM atom table is a fixed-size resource (default roughly 1,048,576 entries), so each unique attacker-chosen key permanently consumes one slot. An attacker who can influence a permission map that reaches encode_permissions!/1 (for example a permissions map read from a request body and passed into token issuance via encode_permissions_into_claims!/2) can mint an unbounded number of atoms and exhaust the atom table, crashing the entire BEAM node and every service running on it. The sibling decode_permissions/1 is not affected because it skips keys absent from the configured permission set.
This issue affects guardian: from 2.0.0 before 2.4.1.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/01/2026
The vulnerability described represents a critical resource allocation flaw in the ueberauth guardian library that specifically targets the BEAM virtual machine's atom table mechanism. This type of vulnerability falls under the broader category of resource exhaustion attacks and aligns with CWE-770, which addresses allocation of resources without limits or throttling. The issue manifests within the Guardian.Permissions module where the encode_permissions!/1 function processes permission maps by converting each key to an atom using String.to_atom(to_string(k)) before any validation occurs. This premature atom creation creates a fundamental security weakness because atoms in BEAM are immutable and never garbage collected, making them persistent memory consumers that can eventually exhaust the fixed-size atom table.
The technical implementation details reveal a particularly dangerous pattern where the do_encode_permissions/1, encode_permissions_into_claims
/2, creating a comprehensive attack surface where any input that flows through these routines can be exploited.
The operational impact of this vulnerability is severe and directly translates to a denial of service condition that can completely crash the entire BEAM node and all services running within it. When an attacker successfully exhausts the atom table, which typically contains around 1,048,576 entries by default, the system becomes unresponsive and requires complete restart to recover. This represents a catastrophic failure mode that affects not just individual applications but entire infrastructure components running on the same BEAM instance. The vulnerability specifically impacts guardian versions from 2.0.0 through 2.4.0, making it a widespread concern for applications using these library versions.
The attack vector is particularly insidious because it can be triggered through user-controllable inputs that flow into the permission processing pipeline, such as request bodies containing permission maps that are subsequently passed to token issuance functions. This creates an indirect but effective path for attackers to exploit the vulnerability without requiring direct access to system resources. The sibling decode_permissions/1 function remains unaffected because it implements proper filtering by skipping keys that are not present in the configured permission set, demonstrating how proper input validation can prevent such resource exhaustion scenarios. Security practitioners should note this vulnerability's alignment with ATT&CK technique T1499.004 for network denial of service and consider implementing input sanitization measures and resource monitoring to detect potential exploitation attempts.
Mitigation strategies should focus on implementing proper bounds checking and limiting the scope of atom creation within the permission processing pipeline. The recommended solution involves adding validation logic to prevent arbitrary key names from being converted to atoms, particularly by ensuring that all permission keys are validated against a predefined set before any atom conversion occurs. Additionally, implementing rate limiting mechanisms and monitoring for excessive atom table usage can provide early detection capabilities. System administrators should also consider upgrading to guardian version 2.4.1 or later where this vulnerability has been addressed through proper input validation and resource management controls that prevent the unbounded consumption of atom table entries.