CVE-2026-55733: Atom-table exhaustion denial of service in Guardian permissions AtomEncoding via unbounded atom creation
Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom creation from attacker-controlled binary input.
Guardian.Permissions.AtomEncoding encodes permission scopes by passing arbitrary binaries to String.toatom/1. When encode/3 in lib/guardian/permissions/atomencoding.ex is called with a list, each binary entry is handled by the encodevalue/3 binary clause, which calls String.toatom(value) with no allow-list check. The permset argument (the application's small, finite set of legitimate permission names) is discarded, so any external string flows straight into atom creation. This encoder is selected with use Guardian.Permissions, encoding: Guardian.Permissions.AtomEncoding and reached through the imported encode/3 entry point.
String.toatom/1 creates a brand-new atom for every previously unseen binary, atoms are never garbage collected, and the BEAM atom table is fixed at roughly 1,048,576 entries by default. An application that funnels attacker-influenced permission scopes (from a request body, a JWT claim, or other external input) into encode/3 therefore mints one permanent atom per distinct value. A modest stream of varied, unauthenticated input permanently consumes the atom table and crashes the BEAM node with systemlimit, taking down every application running on it.
The default encoder is Guardian.Permissions.BitwiseEncoding, which is not affected.
This issue affects guardian: from 2.0.0 before 2.4.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
guardianto a version that resolves this vulnerability.Fixed in 2.4.1 - Configuration
Modify Guardian.Permissions.AtomEncoding so encode_value/3 does not call String.to_atom(value) without an allow-list/permission-name check; only encode from the application's finite perm_set and prevent external binary scope values from being used to create new atoms.
Guardian.Permissions.AtomEncoding allow-list/check before String.to_atom/1 = enabled - Configuration
Use the default (non-atom-creating) encoder by configuring Guardian.Permissions to use Guardian.Permissions.BitwiseEncoding instead of Guardian.Permissions.AtomEncoding (the BitwiseEncoding encoder is noted as not affected by this atom-table exhaustion issue).
Guardian.Permissions encoding = Guardian.Permissions.BitwiseEncoding - Compensating control
Implement request-level throttling/limits on untrusted inputs reaching Guardian permissions encoding (to prevent unbounded atom creation attempts via attacker-controlled scope binaries prior to fully upgrading/configuring encoders).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-55733?
CVE-2026-55733 has a severity score of 75, indicating a high risk of denial of service.
How does CVE-2026-55733 allow an attacker to exploit a system?
CVE-2026-55733 allows an attacker to cause denial of service by creating an unbounded number of atoms through arbitrary binary input.
Which software is affected by CVE-2026-55733?
CVE-2026-55733 affects the Guardian permissions in the ueberauth guardian software.
How can I mitigate CVE-2026-55733?
Mitigation for CVE-2026-55733 involves implementing limits on atom creation and validating binary inputs before processing.
What are the consequences of failing to address CVE-2026-55733?
Failing to address CVE-2026-55733 can lead to service interruptions due to denial of service attacks by saturating atom resources.