CVE-2026-55733
Received Received - Intake

Allocation of Resources Without Limits in Guardian

Publication date: 2026-08-01

Last updated on: 2026-08-01

Assigner: EEF

Description
Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom creation from attacker-controlled binary input. Guardian.Permissions.AtomEncoding encodes permission scopes by passing arbitrary binaries to String.to_atom/1. When encode/3 in lib/guardian/permissions/atom_encoding.ex is called with a list, each binary entry is handled by the encode_value/3 binary clause, which calls String.to_atom(value) with no allow-list check. The perm_set argument (the application's small, finite set of legitimate permission names) is discarded, so any external string flows straight into atom creation. This encoder is selected with use Guardian.Permissions, encoding: Guardian.Permissions.AtomEncoding and reached through the imported encode/3 entry point. String.to_atom/1 creates a brand-new atom for every previously unseen binary, atoms are never garbage collected, and the BEAM atom table is fixed at roughly 1,048,576 entries by default. An application that funnels attacker-influenced permission scopes (from a request body, a JWT claim, or other external input) into encode/3 therefore mints one permanent atom per distinct value. A modest stream of varied, unauthenticated input permanently consumes the atom table and crashes the BEAM node with system_limit, taking down every application running on it. The default encoder is Guardian.Permissions.BitwiseEncoding, which is not affected. This issue affects guardian: from 2.0.0 before 2.4.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-01
Last Modified
2026-08-01
Generated
2026-08-02
AI Q&A
2026-08-01
EPSS Evaluated
N/A
NVD
CVE-2026-55733
EUVD
EUVD-2026-51916

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
guardian guardian From 2.0.0 (inc) to 2.4.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a denial of service issue in the ueberauth guardian library. It occurs when attacker-controlled binary input is used to create an excessive number of atoms in the BEAM runtime. The AtomEncoding module converts permission scopes into atoms without limits, and since atoms are never garbage collected, the atom table fills up and crashes the system.

Detection Guidance

Check for excessive atom creation by monitoring BEAM node memory and atom table usage. Use Erlang shell commands like 'erlang:memory(atom)' to inspect atom table size and 'erlang:system_info(atom_count)' to get the current atom count. High atom counts may indicate exploitation.

Impact Analysis

An attacker could send crafted permission scopes to consume the atom table, causing the BEAM node to crash. This would take down all applications running on the same node, leading to service disruption and downtime.

Compliance Impact

This vulnerability could lead to denial of service attacks, causing system outages that may violate compliance requirements for availability under standards like GDPR and HIPAA. Unbounded atom creation may also indicate insufficient input validation, potentially compromising data integrity and confidentiality if exploited to access unauthorized resources.

Mitigation Strategies

Upgrade to Guardian version 2.4.1 or later to fix the issue. If immediate upgrade is not possible, switch to the default BitwiseEncoding by setting encoding: Guardian.Permissions.BitwiseEncoding in your Guardian configuration to avoid atom creation from external input.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55733. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart