CVE-2026-55733
Full vulnerability record from the local CVENow database.
Description
Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom creation from attacker-controlled binary input. Guardian.Permissions.AtomEncoding encodes permission scopes by passing arbitrary binaries to String.to_atom/1. When encode/3 in lib/guardian/permissions/atom_encoding.ex is called with a list, each binary entry is handled by the encode_value/3 binary clause, which calls String.to_atom(value) with no allow-list check. The perm_set argument (the application's small, finite set of legitimate permission names) is discarded, so any external string flows straight into atom creation. This encoder is selected with use Guardian.Permissions, encoding: Guardian.Permissions.AtomEncoding and reached through the imported encode/3 entry point. String.to_atom/1 creates a brand-new atom for every previously unseen binary, atoms are never garbage collected, and the BEAM atom table is fixed at roughly 1,048,576 entries by default. An application that funnels attacker-influenced permission scopes (from a request body, a JWT claim, or other external input) into encode/3 therefore mints one permanent atom per distinct value. A modest stream of varied, unauthenticated input permanently consumes the atom table and crashes the BEAM node with system_limit, taking down every application running on it. The default encoder is Guardian.Permissions.BitwiseEncoding, which is not affected. This issue affects guardian: from 2.0.0 before 2.4.1.
Severity
MEDIUM
CVSS score
6.9
(v4.0)
Vulnerability status
Analyzed
Source identifier
6b3ad84c-e1a6-4bf7-a703-f496b71e49db
Published
2026-08-01 19:16:42.157000
Last modified
2026-10-23 22:10:00.160000
View original CVE JSON
{
"id": "CVE-2026-55733",
"sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"published": "2026-08-01T19:16:42.157",
"lastModified": "2026-10-23T22:10:00.160",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom creation from attacker-controlled binary input.\n\nGuardian.Permissions.AtomEncoding encodes permission scopes by passing arbitrary binaries to String.to_atom/1. When encode/3 in lib/guardian/permissions/atom_encoding.ex is called with a list, each binary entry is handled by the encode_value/3 binary clause, which calls String.to_atom(value) with no allow-list check. The perm_set argument (the application's small, finite set of legitimate permission names) is discarded, so any external string flows straight into atom creation. This encoder is selected with use Guardian.Permissions, encoding: Guardian.Permissions.AtomEncoding and reached through the imported encode/3 entry point.\n\nString.to_atom/1 creates a brand-new atom for every previously unseen binary, atoms are never garbage collected, and the BEAM atom table is fixed at roughly 1,048,576 entries by default. An application that funnels attacker-influenced permission scopes (from a request body, a JWT claim, or other external input) into encode/3 therefore mints one permanent atom per distinct value. A modest stream of varied, unauthenticated input permanently consumes the atom table and crashes the BEAM node with system_limit, taking down every application running on it.\n\nThe default encoder is Guardian.Permissions.BitwiseEncoding, which is not affected.\n\nThis issue affects guardian: from 2.0.0 before 2.4.1."
},
{
"lang": "es",
"value": "La asignación de recursos sin límites ni estrangulamiento en ueberauth guardian permite la denegación de servicio a través de la creación ilimitada de átomos a partir de entrada binaria controlada por el atacante.\n\nGuardian.Permissions.AtomEncoding codifica los ámbitos de permiso pasando binarios arbitrarios a String.to_atom/1. Cuando se llama a encode/3 en lib/guardian/permissions/atom_encoding.ex con una lista, cada entrada binaria es manejada por la cláusula binaria encode_value/3, que llama a String.to_atom(value) sin una verificación de lista de permitidos. El argumento perm_set (el conjunto pequeño y finito de nombres de permiso legítimos de la aplicación) se descarta, por lo que cualquier cadena externa fluye directamente a la creación de átomos. Este codificador se selecciona con use Guardian.Permissions, encoding: Guardian.Permissions.AtomEncoding y se alcanza a través del punto de entrada importado encode/3.\n\nString.to_atom/1 crea un átomo completamente nuevo para cada binario no visto previamente, los átomos nunca son recolectados por el recolector de basura, y la tabla de átomos de BEAM está fijada en aproximadamente 1.048.576 entradas por defecto. Una aplicación que canaliza ámbitos de permiso influenciados por el atacante (desde un cuerpo de solicitud, una declaración JWT u otra entrada externa) en encode/3, por lo tanto, acuña un átomo permanente por cada valor distinto. Un flujo modesto de entrada variada y no autenticada consume permanentemente la tabla de átomos y bloquea el nodo BEAM con system_limit, derribando todas las aplicaciones que se ejecutan en él.\n\nEl codificador predeterminado es Guardian.Permissions.BitwiseEncoding, el cual no se ve afectado.\n\nEste problema afecta a guardian: desde la versión 2.0.0 hasta antes de la 2.4.1."
}
],
"affected": [
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"affectedData": [
{
"vendor": "ueberauth",
"product": "guardian",
"defaultStatus": "unaffected",
"collectionURL": "https://repo.hex.pm",
"packageName": "guardian",
"cpes": [
"cpe:2.3:a:ueberauth:guardian:*:*:*:*:*:*:*:*"
],
"modules": [
"'Elixir.Guardian.Permissions.AtomEncoding'"
],
"programFiles": [
"lib/guardian/permissions/atom_encoding.ex"
],
"programRoutines": [
{
"name": "'Elixir.Guardian.Permissions.AtomEncoding':encode/3"
},
{
"name": "'Elixir.Guardian.Permissions.AtomEncoding':encode_value/3"
}
],
"repo": "https://github.com/ueberauth/guardian",
"packageURL": "pkg:hex/guardian",
"versions": [
{
"version": "2.0.0",
"lessThan": "2.4.1",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "ueberauth",
"product": "guardian",
"defaultStatus": "unaffected",
"collectionURL": "https://github.com",
"packageName": "ueberauth/guardian",
"cpes": [
"cpe:2.3:a:ueberauth:guardian:*:*:*:*:*:*:*:*"
],
"modules": [
"'Elixir.Guardian.Permissions.AtomEncoding'"
],
"programFiles": [
"lib/guardian/permissions/atom_encoding.ex"
],
"programRoutines": [
{
"name": "'Elixir.Guardian.Permissions.AtomEncoding':encode/3"
},
{
"name": "'Elixir.Guardian.Permissions.AtomEncoding':encode_value/3"
}
],
"repo": "https://github.com/ueberauth/guardian",
"packageURL": "pkg:github/ueberauth/guardian",
"versions": [
{
"version": "b7a6128ca4d0ffb7f7df5219dd982304ff9d6802",
"lessThan": "9cd268557846aa4c3ad53566c08f2c190ee5513f",
"versionType": "git",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-08-03T16:50:27.758398Z",
"id": "CVE-2026-55733",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-770"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ueberauth:guardian:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2.0.0",
"versionEndExcluding": "2.4.1",
"matchCriteriaId": "6D3467C6-6791-452B-8FB8-A4B7D7F8472A"
}
]
}
]
}
],
"references": [
{
"url": "https://cna.erlef.org/cves/CVE-2026-55733.html",
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Third Party Advisory"
]
},
{
"url": "https://github.com/ueberauth/guardian/commit/9cd268557846aa4c3ad53566c08f2c190ee5513f",
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Patch"
]
},
{
"url": "https://github.com/ueberauth/guardian/security/advisories/GHSA-fjr5-7xrc-hmpj",
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Exploit",
"Patch",
"Vendor Advisory"
]
},
{
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-55733",
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Third Party Advisory"
]
},
{
"url": "https://github.com/ueberauth/guardian/security/advisories/GHSA-fjr5-7xrc-hmpj",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"tags": [
"Exploit",
"Patch",
"Vendor Advisory"
]
}
]
}