CVE-2026-55733 (GCVE-0-2026-55733)
Vulnerability from cvelistv5 – Published: 2026-08-01 18:46 – Updated: 2026-08-01 18:46
VLAI
EPSS
VEX
Title
Atom-table exhaustion denial of service in Guardian permissions AtomEncoding via unbounded atom creation
Summary
Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom creation from attacker-controlled binary input.
Guardian.Permissions.AtomEncoding encodes permission scopes by passing arbitrary binaries to String.to_atom/1. When encode/3 in lib/guardian/permissions/atom_encoding.ex is called with a list, each binary entry is handled by the encode_value/3 binary clause, which calls String.to_atom(value) with no allow-list check. The perm_set argument (the application's small, finite set of legitimate permission names) is discarded, so any external string flows straight into atom creation. This encoder is selected with use Guardian.Permissions, encoding: Guardian.Permissions.AtomEncoding and reached through the imported encode/3 entry point.
String.to_atom/1 creates a brand-new atom for every previously unseen binary, atoms are never garbage collected, and the BEAM atom table is fixed at roughly 1,048,576 entries by default. An application that funnels attacker-influenced permission scopes (from a request body, a JWT claim, or other external input) into encode/3 therefore mints one permanent atom per distinct value. A modest stream of varied, unauthenticated input permanently consumes the atom table and crashes the BEAM node with system_limit, taking down every application running on it.
The default encoder is Guardian.Permissions.BitwiseEncoding, which is not affected.
This issue affects guardian: from 2.0.0 before 2.4.1.
Severity
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ueberauth/guardian/security/ad… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-55733.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-55733 | related |
| https://github.com/ueberauth/guardian/commit/9cd2… | patch |
Impacted products
Credits
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ueberauth:guardian:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Guardian.Permissions.AtomEncoding\u0027"
],
"packageName": "guardian",
"packageURL": "pkg:hex/guardian",
"product": "guardian",
"programFiles": [
"lib/guardian/permissions/atom_encoding.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Guardian.Permissions.AtomEncoding\u0027:encode/3"
},
{
"name": "\u0027Elixir.Guardian.Permissions.AtomEncoding\u0027:encode_value/3"
}
],
"repo": "https://github.com/ueberauth/guardian",
"vendor": "ueberauth",
"versions": [
{
"lessThan": "2.4.1",
"status": "affected",
"version": "2.0.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ueberauth:guardian:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Guardian.Permissions.AtomEncoding\u0027"
],
"packageName": "ueberauth/guardian",
"packageURL": "pkg:github/ueberauth/guardian",
"product": "guardian",
"programFiles": [
"lib/guardian/permissions/atom_encoding.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Guardian.Permissions.AtomEncoding\u0027:encode/3"
},
{
"name": "\u0027Elixir.Guardian.Permissions.AtomEncoding\u0027:encode_value/3"
}
],
"repo": "https://github.com/ueberauth/guardian",
"vendor": "ueberauth",
"versions": [
{
"lessThan": "9cd268557846aa4c3ad53566c08f2c190ee5513f",
"status": "affected",
"version": "b7a6128ca4d0ffb7f7df5219dd982304ff9d6802",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOnly applications that opt into the non-default \u003ctt\u003eGuardian.Permissions.AtomEncoding\u003c/tt\u003e encoder (via \u003ctt\u003euse Guardian.Permissions, encoding: Guardian.Permissions.AtomEncoding\u003c/tt\u003e) and pass attacker-influenced permission scopes into its \u003ctt\u003eencode/3\u003c/tt\u003e entry point are exploitable. The default \u003ctt\u003eGuardian.Permissions.BitwiseEncoding\u003c/tt\u003e encoder and the \u003ctt\u003eGuardian.Permissions.TextEncoding\u003c/tt\u003e encoder do not create atoms and are not affected.\u003c/p\u003e"
}
],
"value": "Only applications that opt into the non-default Guardian.Permissions.AtomEncoding encoder (via use Guardian.Permissions, encoding: Guardian.Permissions.AtomEncoding) and pass attacker-influenced permission scopes into its encode/3 entry point are exploitable. The default Guardian.Permissions.BitwiseEncoding encoder and the Guardian.Permissions.TextEncoding encoder do not create atoms and are not affected."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ueberauth:guardian:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.4.1",
"versionStartIncluding": "2.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Yordis Prieto"
},
{
"lang": "en",
"type": "analyst",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAllocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom creation from attacker-controlled binary input.\u003c/p\u003e\u003cp\u003e\u003ctt\u003eGuardian.Permissions.AtomEncoding\u003c/tt\u003e encodes permission scopes by passing arbitrary binaries to \u003ctt\u003eString.to_atom/1\u003c/tt\u003e. When \u003ctt\u003eencode/3\u003c/tt\u003e in \u003ctt\u003elib/guardian/permissions/atom_encoding.ex\u003c/tt\u003e is called with a list, each binary entry is handled by the \u003ctt\u003eencode_value/3\u003c/tt\u003e binary clause, which calls \u003ctt\u003eString.to_atom(value)\u003c/tt\u003e with no allow-list check. The \u003ctt\u003eperm_set\u003c/tt\u003e argument (the application\u0027s small, finite set of legitimate permission names) is discarded, so any external string flows straight into atom creation. This encoder is selected with \u003ctt\u003euse Guardian.Permissions, encoding: Guardian.Permissions.AtomEncoding\u003c/tt\u003e and reached through the imported \u003ctt\u003eencode/3\u003c/tt\u003e entry point.\u003c/p\u003e\u003cp\u003e\u003ctt\u003eString.to_atom/1\u003c/tt\u003e creates a brand-new atom for every previously unseen binary, atoms are never garbage collected, and the BEAM atom table is fixed at roughly 1,048,576 entries by default. An application that funnels attacker-influenced permission scopes (from a request body, a JWT claim, or other external input) into \u003ctt\u003eencode/3\u003c/tt\u003e therefore mints one permanent atom per distinct value. A modest stream of varied, unauthenticated input permanently consumes the atom table and crashes the BEAM node with \u003ctt\u003esystem_limit\u003c/tt\u003e, taking down every application running on it.\u003c/p\u003e\u003cp\u003eThe default encoder is \u003ctt\u003eGuardian.Permissions.BitwiseEncoding\u003c/tt\u003e, which is not affected.\u003c/p\u003e\u003cp\u003eThis issue affects guardian: from 2.0.0 before 2.4.1.\u003c/p\u003e"
}
],
"value": "Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom creation from attacker-controlled binary input.\n\nGuardian.Permissions.AtomEncoding encodes permission scopes by passing arbitrary binaries to String.to_atom/1. When encode/3 in lib/guardian/permissions/atom_encoding.ex is called with a list, each binary entry is handled by the encode_value/3 binary clause, which calls String.to_atom(value) with no allow-list check. The perm_set argument (the application\u0027s small, finite set of legitimate permission names) is discarded, so any external string flows straight into atom creation. This encoder is selected with use Guardian.Permissions, encoding: Guardian.Permissions.AtomEncoding and reached through the imported encode/3 entry point.\n\nString.to_atom/1 creates a brand-new atom for every previously unseen binary, atoms are never garbage collected, and the BEAM atom table is fixed at roughly 1,048,576 entries by default. An application that funnels attacker-influenced permission scopes (from a request body, a JWT claim, or other external input) into encode/3 therefore mints one permanent atom per distinct value. A modest stream of varied, unauthenticated input permanently consumes the atom table and crashes the BEAM node with system_limit, taking down every application running on it.\n\nThe default encoder is Guardian.Permissions.BitwiseEncoding, which is not affected.\n\nThis issue affects guardian: from 2.0.0 before 2.4.1."
}
],
"impacts": [
{
"capecId": "CAPEC-130",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-130 Excessive Allocation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-01T18:46:12.113Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ueberauth/guardian/security/advisories/GHSA-fjr5-7xrc-hmpj"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-55733.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-55733"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ueberauth/guardian/commit/9cd268557846aa4c3ad53566c08f2c190ee5513f"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Atom-table exhaustion denial of service in Guardian permissions AtomEncoding via unbounded atom creation",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eSwitch the permission encoder to the default \u003ctt\u003eGuardian.Permissions.BitwiseEncoding\u003c/tt\u003e or to \u003ctt\u003eGuardian.Permissions.TextEncoding\u003c/tt\u003e, neither of which creates atoms. Alternatively, validate every permission value against the configured \u003ctt\u003eperm_set\u003c/tt\u003e allowlist (rejecting unknown values) before passing it to \u003ctt\u003eencode/3\u003c/tt\u003e.\u003c/p\u003e"
}
],
"value": "Switch the permission encoder to the default Guardian.Permissions.BitwiseEncoding or to Guardian.Permissions.TextEncoding, neither of which creates atoms. Alternatively, validate every permission value against the configured perm_set allowlist (rejecting unknown values) before passing it to encode/3."
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-55733",
"datePublished": "2026-08-01T18:46:12.113Z",
"dateReserved": "2026-06-17T10:44:34.365Z",
"dateUpdated": "2026-08-01T18:46:12.113Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-55733",
"date": "2026-08-03",
"epss": "0.00126",
"percentile": "0.02708"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2026-55733\",\"sourceIdentifier\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"published\":\"2026-08-01T19:16:42.157\",\"lastModified\":\"2026-08-01T19:16:42.157\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom creation from attacker-controlled binary input.\\n\\nGuardian.Permissions.AtomEncoding encodes permission scopes by passing arbitrary binaries to String.to_atom/1. When encode/3 in lib/guardian/permissions/atom_encoding.ex is called with a list, each binary entry is handled by the encode_value/3 binary clause, which calls String.to_atom(value) with no allow-list check. The perm_set argument (the application\u0027s small, finite set of legitimate permission names) is discarded, so any external string flows straight into atom creation. This encoder is selected with use Guardian.Permissions, encoding: Guardian.Permissions.AtomEncoding and reached through the imported encode/3 entry point.\\n\\nString.to_atom/1 creates a brand-new atom for every previously unseen binary, atoms are never garbage collected, and the BEAM atom table is fixed at roughly 1,048,576 entries by default. An application that funnels attacker-influenced permission scopes (from a request body, a JWT claim, or other external input) into encode/3 therefore mints one permanent atom per distinct value. A modest stream of varied, unauthenticated input permanently consumes the atom table and crashes the BEAM node with system_limit, taking down every application running on it.\\n\\nThe default encoder is Guardian.Permissions.BitwiseEncoding, which is not affected.\\n\\nThis issue affects guardian: from 2.0.0 before 2.4.1.\"}],\"affected\":[{\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"affectedData\":[{\"vendor\":\"ueberauth\",\"product\":\"guardian\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://repo.hex.pm\",\"packageName\":\"guardian\",\"cpes\":[\"cpe:2.3:a:ueberauth:guardian:*:*:*:*:*:*:*:*\"],\"modules\":[\"\u0027Elixir.Guardian.Permissions.AtomEncoding\u0027\"],\"programFiles\":[\"lib/guardian/permissions/atom_encoding.ex\"],\"programRoutines\":[{\"name\":\"\u0027Elixir.Guardian.Permissions.AtomEncoding\u0027:encode/3\"},{\"name\":\"\u0027Elixir.Guardian.Permissions.AtomEncoding\u0027:encode_value/3\"}],\"repo\":\"https://github.com/ueberauth/guardian\",\"packageURL\":\"pkg:hex/guardian\",\"versions\":[{\"version\":\"2.0.0\",\"lessThan\":\"2.4.1\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"ueberauth\",\"product\":\"guardian\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://github.com\",\"packageName\":\"ueberauth/guardian\",\"cpes\":[\"cpe:2.3:a:ueberauth:guardian:*:*:*:*:*:*:*:*\"],\"modules\":[\"\u0027Elixir.Guardian.Permissions.AtomEncoding\u0027\"],\"programFiles\":[\"lib/guardian/permissions/atom_encoding.ex\"],\"programRoutines\":[{\"name\":\"\u0027Elixir.Guardian.Permissions.AtomEncoding\u0027:encode/3\"},{\"name\":\"\u0027Elixir.Guardian.Permissions.AtomEncoding\u0027:encode_value/3\"}],\"repo\":\"https://github.com/ueberauth/guardian\",\"packageURL\":\"pkg:github/ueberauth/guardian\",\"versions\":[{\"version\":\"b7a6128ca4d0ffb7f7df5219dd982304ff9d6802\",\"lessThan\":\"9cd268557846aa4c3ad53566c08f2c190ee5513f\",\"versionType\":\"git\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":6.9,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"PRESENT\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"NONE\",\"vulnAvailabilityImpact\":\"HIGH\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"HIGH\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}]},\"weaknesses\":[{\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-770\"}]}],\"references\":[{\"url\":\"https://cna.erlef.org/cves/CVE-2026-55733.html\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\"},{\"url\":\"https://github.com/ueberauth/guardian/commit/9cd268557846aa4c3ad53566c08f2c190ee5513f\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\"},{\"url\":\"https://github.com/ueberauth/guardian/security/advisories/GHSA-fjr5-7xrc-hmpj\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\"},{\"url\":\"https://osv.dev/vulnerability/EEF-CVE-2026-55733\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\"}]}}"
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
Loading…
Loading…