CVE-2026-54894
Received Received - Intake

Allocation of Resources Without Limits in Guardian

Publication date: 2026-08-01

Last updated on: 2026-08-01

Assigner: EEF

Description
Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom creation from attacker-influenced binary input. Guardian.Plug.Keys derives connection and session namespace keys by passing arbitrary binaries to String.to_atom/1. base_key/1 in lib/guardian/plug/keys.ex converts any binary into the atom :"guardian_<input>", and the derived helpers claims_key/1, resource_key/1, and token_key/1 create a second atom on top of that. key_from_other/1 likewise converts a regex-captured binary through String.to_atom/1. The public specs advertise String.t() as a valid argument, so passing a string is documented usage, and higher-level entry points such as Guardian.Plug.current_token(conn, key: key) thread the caller-supplied key straight into these functions. String.to_atom/1 creates a brand-new atom for every previously unseen binary, atoms are never garbage collected, and the BEAM atom table is fixed at roughly 1,048,576 entries by default. An application that routes attacker-influenced data (a tenant identifier, header, or other request input) into a Guardian key therefore mints one permanent atom per distinct value. A modest stream of varied, unauthenticated input permanently consumes the atom table and crashes the BEAM node, taking down every application running on it. This issue affects guardian: from 0.1.0 before 2.4.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-01
Last Modified
2026-08-01
Generated
2026-08-02
AI Q&A
2026-08-01
EPSS Evaluated
N/A
NVD
CVE-2026-54894
EUVD
EUVD-2026-51915

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
guardian guardian to 2.4.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a denial of service attack in the ueberauth guardian library. It occurs when attacker-controlled binary input is converted into atoms without limits, exhausting the BEAM atom table. The atom table is fixed and never garbage collected, so repeated unique inputs permanently consume entries, crashing the system.

Detection Guidance

This vulnerability is specific to Elixir applications using the guardian library before version 2.4.1. Detection requires checking if your application uses guardian and if the version is vulnerable. Inspect mix.exs for the guardian dependency version. Monitor BEAM node crashes or atom table exhaustion errors in logs.

Impact Analysis

An attacker can send varied unauthenticated requests with unique identifiers or headers, causing the application to mint new atoms until the atom table is full. This crashes the BEAM node, taking down all applications running on it, leading to service unavailability.

Compliance Impact

This vulnerability could lead to denial of service by exhausting the BEAM atom table, crashing applications and potentially disrupting systems handling sensitive data. For GDPR, this may impact availability of personal data processing systems. For HIPAA, it could disrupt healthcare systems managing protected health information.

Mitigation Strategies

Upgrade guardian to version 2.4.1 or later immediately. Avoid passing untrusted input directly into Guardian.Plug.Keys functions. Validate and sanitize all inputs used as keys. Consider using String.to_charlist/1 or binary hashing before atom conversion.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54894. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart