ueberauth guardian up to 2.4.0 AtomEncoding atom_encoding.ex String.to_atom Value allocation of resources

Summaryinfo

A vulnerability, which was classified as problematic, has been found in ueberauth guardian up to 2.4.0. Affected by this issue is the function String.to_atom of the file lib/guardian/permissions/atom_encoding.ex of the component AtomEncoding. This manipulation of the argument Value causes allocation of resources. The identification of this vulnerability is CVE-2026-55733. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability classified as problematic was found in ueberauth guardian up to 2.4.0. Affected by this vulnerability is the function String.to_atom of the file lib/guardian/permissions/atom_encoding.ex of the component AtomEncoding. The manipulation of the argument value with an unknown input leads to a allocation of resources vulnerability. The CWE definition for the vulnerability is CWE-770. The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor. As an impact it is known to affect availability. The summary by CVE is:

Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom creation from attacker-controlled binary input. Guardian.Permissions.AtomEncoding encodes permission scopes by passing arbitrary binaries to String.to_atom/1. When encode/3 in lib/guardian/permissions/atom_encoding.ex is called with a list, each binary entry is handled by the encode_value/3 binary clause, which calls String.to_atom(value) with no allow-list check. The perm_set argument (the application's small, finite set of legitimate permission names) is discarded, so any external string flows straight into atom creation. This encoder is selected with use Guardian.Permissions, encoding: Guardian.Permissions.AtomEncoding and reached through the imported encode/3 entry point. String.to_atom/1 creates a brand-new atom for every previously unseen binary, atoms are never garbage collected, and the BEAM atom table is fixed at roughly 1,048,576 entries by default. An application that funnels attacker-influenced permission scopes (from a request body, a JWT claim, or other external input) into encode/3 therefore mints one permanent atom per distinct value. A modest stream of varied, unauthenticated input permanently consumes the atom table and crashes the BEAM node with system_limit, taking down every application running on it. The default encoder is Guardian.Permissions.BitwiseEncoding, which is not affected. This issue affects guardian: from 2.0.0 before 2.4.1.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-55733 since 06/17/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1499 for this issue.

Upgrading to version 2.4.1 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-51916). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• ueberauth

Name

• guardian

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4.0

Website

• Product: https://github.com/ueberauth/guardian/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion