CVE-2026-54894: Atom-table exhaustion denial of service in Guardian via unbounded atom creation from binary keys
Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom creation from attacker-influenced binary input.
Guardian.Plug.Keys derives connection and session namespace keys by passing arbitrary binaries to String.toatom/1. basekey/1 in lib/guardian/plug/keys.ex converts any binary into the atom :"guardian<input>", and the derived helpers claimskey/1, resourcekey/1, and tokenkey/1 create a second atom on top of that. keyfromother/1 likewise converts a regex-captured binary through String.toatom/1. The public specs advertise String.t() as a valid argument, so passing a string is documented usage, and higher-level entry points such as Guardian.Plug.currenttoken(conn, key: key) thread the caller-supplied key straight into these functions.
String.toatom/1 creates a brand-new atom for every previously unseen binary, atoms are never garbage collected, and the BEAM atom table is fixed at roughly 1,048,576 entries by default. An application that routes attacker-influenced data (a tenant identifier, header, or other request input) into a Guardian key therefore mints one permanent atom per distinct value. A modest stream of varied, unauthenticated input permanently consumes the atom table and crashes the BEAM node, taking down every application running on it.
This issue affects guardian: from 0.1.0 before 2.4.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
guardianto a version that resolves this vulnerability.Fixed in 2.4.1 - Configuration
Ensure Guardian key derivation functions do not convert attacker-influenced inputs into new atoms (e.g., do not use String.to_atom/1 in base_key/1 or key_from_other/1 that derive atoms from request/tenant/header data).
Guardian.Plug.Keys Avoid String.to_atom/1 for attacker-influenced binaries (e.g., key input) = Do not call String.to_atom/1 on untrusted binary input; replace with a bounded, non-atom mapping (e.g., hash/lookup) so new atoms are not created
Event History
Frequently Asked Questions
What is the severity of CVE-2026-54894?
CVE-2026-54894 has a risk rating of 76, indicating a medium to high severity level.
How do I fix CVE-2026-54894?
To mitigate CVE-2026-54894, implement limiting on the input or throttle the creation of atoms to prevent unbounded atom creation from binary keys.
What is the impact of CVE-2026-54894?
CVE-2026-54894 allows an attacker to cause a denial of service by exhausting system resources through unbounded atom creation.
Which software is affected by CVE-2026-54894?
CVE-2026-54894 affects the ueberauth guardian software.
How does CVE-2026-54894 work?
CVE-2026-54894 exploits the conversion of arbitrary binaries to atoms in ueberauth guardian, leading to resource exhaustion.