CVE-2026-54894

Name of the Vulnerable Software and Affected Versions ueberauth guardian versions 0.1.0 through 2.4.0

Description An allocation of resources without limits or throttling allows a denial of service via unbounded atom creation from attacker-influenced binary input. The Guardian.Plug.Keys module derives connection and session namespace keys by passing arbitrary binaries to the String.to atom/1 function. Specifically, the base key/1 function in lib/guardian/plug/keys.ex converts binaries into atoms, and the helpers claims key/1, resource key/1, and token key/1 create additional atoms. Similarly, key from other/1 converts regex-captured binaries through String.to atom/1. High-level entry points, such as Guardian.Plug.current token(conn, key: key), pass caller-supplied keys directly into these functions.

Because String.to atom/1 creates a new atom for every unseen binary and atoms are not garbage collected, the BEAM atom table (which has a default limit of approximately 1,048,576 entries) can be exhausted. If an application routes untrusted data, such as a tenant identifier or request header, into a Guardian key via the key parameter, an attacker can send a stream of varied input to consume the atom table and crash the BEAM node, affecting all applications running on it.

Recommendations Update ueberauth guardian to version 2.4.1 or later. As a temporary workaround, do not derive Guardian keys from untrusted input; instead, use a fixed, hardcoded set of namespace keys or validate values against a bounded allowlist before passing them as the key option.