CVE-2026-55734
Full vulnerability record from the local CVENow database.
Description
Allocation of Resources Without Limits or Throttling vulnerability in ueberauth guardian (Guardian.Permissions module) allows a denial of service via BEAM atom-table exhaustion. This vulnerability is associated with program file lib/guardian/permissions.ex and program routines 'Elixir.Guardian.Permissions':encode_permissions!/1, 'Elixir.Guardian.Permissions':encode_permissions_into_claims!/2, 'Elixir.Guardian.Permissions':do_encode_permissions!/2. The Guardian.Permissions mixin installs a public encode_permissions!/1 function on every module that does use Guardian.Permissions. For each key of the supplied map, encode_permissions!/1 calls String.to_atom(to_string(k)) before any validation runs. The integer-value clause of do_encode_permissions!/2 then short-circuits straight to encoding without validating the key against the configured permission set, so a key with an integer value is interned as a fresh atom with no exception raised. Atoms are never garbage collected and the BEAM atom table is a fixed-size resource (default roughly 1,048,576 entries), so each unique attacker-chosen key permanently consumes one slot. An attacker who can influence a permission map that reaches encode_permissions!/1 (for example a permissions map read from a request body and passed into token issuance via encode_permissions_into_claims!/2) can mint an unbounded number of atoms and exhaust the atom table, crashing the entire BEAM node and every service running on it. The sibling decode_permissions/1 is not affected because it skips keys absent from the configured permission set. This issue affects guardian: from 2.0.0 before 2.4.1.
Severity
MEDIUM
CVSS score
6.9
(v4.0)
Vulnerability status
Analyzed
Source identifier
6b3ad84c-e1a6-4bf7-a703-f496b71e49db
Published
2026-08-01 19:16:42.333000
Last modified
2026-10-23 22:10:00.160000
View original CVE JSON
{
"id": "CVE-2026-55734",
"sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"published": "2026-08-01T19:16:42.333",
"lastModified": "2026-10-23T22:10:00.160",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Allocation of Resources Without Limits or Throttling vulnerability in ueberauth guardian (Guardian.Permissions module) allows a denial of service via BEAM atom-table exhaustion.\n\nThis vulnerability is associated with program file lib/guardian/permissions.ex and program routines 'Elixir.Guardian.Permissions':encode_permissions!/1, 'Elixir.Guardian.Permissions':encode_permissions_into_claims!/2, 'Elixir.Guardian.Permissions':do_encode_permissions!/2.\n\nThe Guardian.Permissions mixin installs a public encode_permissions!/1 function on every module that does use Guardian.Permissions. For each key of the supplied map, encode_permissions!/1 calls String.to_atom(to_string(k)) before any validation runs. The integer-value clause of do_encode_permissions!/2 then short-circuits straight to encoding without validating the key against the configured permission set, so a key with an integer value is interned as a fresh atom with no exception raised. Atoms are never garbage collected and the BEAM atom table is a fixed-size resource (default roughly 1,048,576 entries), so each unique attacker-chosen key permanently consumes one slot. An attacker who can influence a permission map that reaches encode_permissions!/1 (for example a permissions map read from a request body and passed into token issuance via encode_permissions_into_claims!/2) can mint an unbounded number of atoms and exhaust the atom table, crashing the entire BEAM node and every service running on it. The sibling decode_permissions/1 is not affected because it skips keys absent from the configured permission set.\n\nThis issue affects guardian: from 2.0.0 before 2.4.1."
},
{
"lang": "es",
"value": "La vulnerabilidad de asignación de recursos sin límites ni limitación en ueberauth guardian (módulo Guardian.Permissions) permite una denegación de servicio a través del agotamiento de la tabla de átomos de BEAM.\n\nEsta vulnerabilidad está asociada con el archivo de programa lib/guardian/permissions.ex y las rutinas de programa ’Elixir.Guardian.Permissions’:encode_permissions!/1, ’Elixir.Guardian.Permissions’:encode_permissions_into_claims!/2, ’Elixir.Guardian.Permissions’:do_encode_permissions!/2.\n\nEl mixin Guardian.Permissions instala una función pública encode_permissions!/1 en cada módulo que utiliza Guardian.Permissions. Para cada clave del mapa proporcionado, encode_permissions!/1 llama a String.to_atom(to_string(k)) antes de que se ejecute cualquier validación. La cláusula de valor entero de do_encode_permissions!/2 entonces hace un cortocircuito directamente a la codificación sin validar la clave contra el conjunto de permisos configurado, por lo que una clave con un valor entero se interna como un átomo nuevo sin que se genere ninguna excepción. Los átomos nunca son recolectados por el recolector de basura y la tabla de átomos de BEAM es un recurso de tamaño fijo (por defecto, aproximadamente 1.048.576 entradas), por lo que cada clave única elegida por el atacante consume permanentemente una ranura. Un atacante que puede influir en un mapa de permisos que llega a encode_permissions!/1 (por ejemplo, un mapa de permisos leído de un cuerpo de solicitud y pasado a la emisión de tokens a través de encode_permissions_into_claims!/2) puede acuñar un número ilimitado de átomos y agotar la tabla de átomos, colapsando todo el nodo BEAM y cada servicio que se ejecuta en él. El hermano decode_permissions/1 no se ve afectado porque omite las claves ausentes del conjunto de permisos configurado.\n\nEste problema afecta a guardian: desde 2.0.0 antes de 2.4.1."
}
],
"affected": [
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"affectedData": [
{
"vendor": "ueberauth",
"product": "guardian",
"defaultStatus": "unaffected",
"collectionURL": "https://repo.hex.pm",
"packageName": "guardian",
"cpes": [
"cpe:2.3:a:ueberauth:guardian:*:*:*:*:*:*:*:*"
],
"modules": [
"'Elixir.Guardian.Permissions'"
],
"programFiles": [
"lib/guardian/permissions.ex"
],
"programRoutines": [
{
"name": "'Elixir.Guardian.Permissions':encode_permissions!/1"
},
{
"name": "'Elixir.Guardian.Permissions':encode_permissions_into_claims!/2"
},
{
"name": "'Elixir.Guardian.Permissions':do_encode_permissions!/2"
}
],
"repo": "https://github.com/ueberauth/guardian",
"packageURL": "pkg:hex/guardian",
"versions": [
{
"version": "2.0.0",
"lessThan": "2.4.1",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "ueberauth",
"product": "guardian",
"defaultStatus": "unaffected",
"collectionURL": "https://github.com",
"packageName": "ueberauth/guardian",
"cpes": [
"cpe:2.3:a:ueberauth:guardian:*:*:*:*:*:*:*:*"
],
"modules": [
"'Elixir.Guardian.Permissions'"
],
"programFiles": [
"lib/guardian/permissions.ex"
],
"programRoutines": [
{
"name": "'Elixir.Guardian.Permissions':encode_permissions!/1"
},
{
"name": "'Elixir.Guardian.Permissions':encode_permissions_into_claims!/2"
},
{
"name": "'Elixir.Guardian.Permissions':do_encode_permissions!/2"
}
],
"repo": "https://github.com/ueberauth/guardian",
"packageURL": "pkg:github/ueberauth/guardian",
"versions": [
{
"version": "b7a6128ca4d0ffb7f7df5219dd982304ff9d6802",
"lessThan": "8d4efbfc352d30f5fcfc75a4d69a795b0e472724",
"versionType": "git",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-08-03T16:49:36.457207Z",
"id": "CVE-2026-55734",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-770"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ueberauth:guardian:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2.0.0",
"versionEndExcluding": "2.4.1",
"matchCriteriaId": "6D3467C6-6791-452B-8FB8-A4B7D7F8472A"
}
]
}
]
}
],
"references": [
{
"url": "https://cna.erlef.org/cves/CVE-2026-55734.html",
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Third Party Advisory"
]
},
{
"url": "https://github.com/ueberauth/guardian/commit/8d4efbfc352d30f5fcfc75a4d69a795b0e472724",
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Patch"
]
},
{
"url": "https://github.com/ueberauth/guardian/security/advisories/GHSA-9qx2-v587-q3gg",
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Exploit",
"Patch",
"Vendor Advisory"
]
},
{
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-55734",
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"tags": [
"Third Party Advisory"
]
},
{
"url": "https://github.com/ueberauth/guardian/security/advisories/GHSA-9qx2-v587-q3gg",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"tags": [
"Exploit",
"Patch",
"Vendor Advisory"
]
}
]
}