CVE-2026-55733

Name of the Vulnerable Software and Affected Versions ueberauth guardian versions 2.0.0 through 2.4.0

Description An allocation of resources without limits or throttling allows a denial of service via unbounded atom creation from attacker-controlled binary input. The Guardian.Permissions.AtomEncoding encoder processes permission scopes by passing arbitrary binaries to the String.to atom/1 function. When the encode/3 function in lib/guardian/permissions/atom encoding.ex is called with a list, the encode value/3 binary clause calls String.to atom(value) without an allow-list check, discarding the perm set argument.

Because String.to atom/1 creates a new atom for every unseen binary and atoms are not garbage collected, the BEAM atom table (limited to approximately 1,048,576 entries) can be exhausted. An attacker providing varied input through request bodies or JWT claims can trigger a system limit crash of the BEAM node, affecting all applications running on it.

Recommendations Update ueberauth guardian to version 2.4.1 or later. As a temporary workaround, switch the permission encoder to Guardian.Permissions.BitwiseEncoding or Guardian.Permissions.TextEncoding. As a temporary workaround, validate every permission value against the configured perm set allowlist before passing it to the encode/3 function.