The vulnerability originates from the implicit conversion of arbitrary binary input into atoms using String.to_atom/1 within the Guardian.Plug.Keys module. Each unseen binary payload is turned into a permanent atom, and atoms are never garbage collected in the BEAM virtual machine. When an application that uses Guardian receives attacker‑controlled inputs—such as tenant identifiers, headers or other request data—it continuously creates new atoms, eventually exhausting the fixed atom table (approximately 1,048,576 entries). Once full, the BEAM node crashes, which takes down every process and application residing on that node, causing a denial‑of‑service condition. The impact is limited to availability; confidentiality and integrity are not directly affected by this flaw.

The flaw affects the Guardian library distributed by ueberauth, covering versions 0.1.0 up to but not including 2.4.1. Any installation of Guardian within that range that derives namespace or session keys from external input is vulnerable.

The CVSS score of 6.9 classifies this as a moderate severity issue, and the EPSS score of less than 1 % indicates a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by supplying a stream of unique, user‑controlled values—such as distinct header values, query parameters, or session identifiers—to the :key option of Guardian.Plug, triggering uncontrolled atom creation. If exploited, the BEAM node will terminate, resulting in a service outage for all applications running on the same virtual machine.