Description
Allocation of Resources Without Limits or Throttling vulnerability in ueberauth guardian (Guardian.Permissions module) allows a denial of service via BEAM atom-table exhaustion.

This vulnerability is associated with program file lib/guardian/permissions.ex and program routines 'Elixir.Guardian.Permissions':encode_permissions!/1, 'Elixir.Guardian.Permissions':encode_permissions_into_claims!/2, 'Elixir.Guardian.Permissions':do_encode_permissions!/2.

The Guardian.Permissions mixin installs a public encode_permissions!/1 function on every module that does use Guardian.Permissions. For each key of the supplied map, encode_permissions!/1 calls String.to_atom(to_string(k)) before any validation runs. The integer-value clause of do_encode_permissions!/2 then short-circuits straight to encoding without validating the key against the configured permission set, so a key with an integer value is interned as a fresh atom with no exception raised. Atoms are never garbage collected and the BEAM atom table is a fixed-size resource (default roughly 1,048,576 entries), so each unique attacker-chosen key permanently consumes one slot. An attacker who can influence a permission map that reaches encode_permissions!/1 (for example a permissions map read from a request body and passed into token issuance via encode_permissions_into_claims!/2) can mint an unbounded number of atoms and exhaust the atom table, crashing the entire BEAM node and every service running on it. The sibling decode_permissions/1 is not affected because it skips keys absent from the configured permission set.

This issue affects guardian: from 2.0.0 before 2.4.1.
Published: 2026-08-01
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The Guardian.Permissions module in ueberauth Guardian can create arbitrary BEAM atoms from any key passed to its encode_permissions!/1 function. Each new atom consumes a slot in the BEAM atom table, which is a fixed size and not garbage collected. Because the function does not validate integer‑valued keys against the configured permission set, an attacker can provide an unbounded number of unique keys and permanently exhaust the atom table, causing the entire BEAM node and all applications running on it to crash. This is a classic example of CWE‑770: Allocation of Resources Without Limits or Throttling.

Affected Systems

The vulnerability affects the Ueberauth Guardian library, specifically versions from 2.0.0 up to, but not including, 2.4.1. The issue arises in the Guardian.Permissions mixin that is installed on any module that uses Guardian.Permissions.

Risk and Exploitability

The CVSS score is 6.9, indicating a moderate severity vulnerability. The EPSS score is less than 1%, reflecting a very low probability of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote, as an attacker could influence the permission map that is passed into the encode_permissions!/1 routine, for example through a request body in an API call. Once the atom table is exhausted, the node terminates, resulting in a denial of service for all services that depend on that BEAM node.

Generated by OpenCVE AI on August 4, 2026 at 11:12 UTC.

Remediation

Vendor Workaround

Before calling encode_permissions!/1 or encode_permissions_into_claims!/2, filter the permission map so that only keys belonging to the configured permission set are passed in, discarding any unknown keys. Avoid passing attacker-influenced permission maps into these functions.

OpenCVE Recommended Actions

  • Before calling encode_permissions!/1 or encode_permissions_into_claims!/2, filter the permission map so that only keys belonging to the configured permission set are passed in, discarding any unknown keys. Avoid passing attacker‑influenced permission maps into these functions.
  • Upgrade the Guardian library to version 2.4.1 or newer, which contains a fix for the unchecked atom creation.
  • If the library upgrade cannot be performed immediately, remove or disable any usage of encode_permissions!/1 and encode_permissions_into_claims!/2 from modules that accept input from untrusted sources until the library fix is applied.

Generated by OpenCVE AI on August 4, 2026 at 11:12 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 03 Aug 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sat, 01 Aug 2026 19:00:00 +0000

Type Values Removed Values Added
Description Allocation of Resources Without Limits or Throttling vulnerability in ueberauth guardian (Guardian.Permissions module) allows a denial of service via BEAM atom-table exhaustion. This vulnerability is associated with program file lib/guardian/permissions.ex and program routines 'Elixir.Guardian.Permissions':encode_permissions!/1, 'Elixir.Guardian.Permissions':encode_permissions_into_claims!/2, 'Elixir.Guardian.Permissions':do_encode_permissions!/2. The Guardian.Permissions mixin installs a public encode_permissions!/1 function on every module that does use Guardian.Permissions. For each key of the supplied map, encode_permissions!/1 calls String.to_atom(to_string(k)) before any validation runs. The integer-value clause of do_encode_permissions!/2 then short-circuits straight to encoding without validating the key against the configured permission set, so a key with an integer value is interned as a fresh atom with no exception raised. Atoms are never garbage collected and the BEAM atom table is a fixed-size resource (default roughly 1,048,576 entries), so each unique attacker-chosen key permanently consumes one slot. An attacker who can influence a permission map that reaches encode_permissions!/1 (for example a permissions map read from a request body and passed into token issuance via encode_permissions_into_claims!/2) can mint an unbounded number of atoms and exhaust the atom table, crashing the entire BEAM node and every service running on it. The sibling decode_permissions/1 is not affected because it skips keys absent from the configured permission set. This issue affects guardian: from 2.0.0 before 2.4.1.
Title guardian atom exhaustion in Guardian.Permissions.encode_permissions!/1
First Time appeared Ueberauth
Ueberauth guardian
Weaknesses CWE-770
CPEs cpe:2.3:a:ueberauth:guardian:*:*:*:*:*:*:*:*
Vendors & Products Ueberauth
Ueberauth guardian
References
Metrics cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H'}

Subscriptions

Ueberauth Guardian
cve-icon MITRE

Status: PUBLISHED

Assigner: EEF

Published:

Updated: 2026-08-03T16:49:59.913Z

Reserved: 2026-06-17T10:44:34.365Z

Link: CVE-2026-55734

cve-icon Vulnrichment

Updated: 2026-08-03T16:49:54.930Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-01T19:16:42.333

Modified: 2026-08-06T14:25:49.940

Link: CVE-2026-55734

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T11:15:06Z

Weaknesses
  • CWE-770

    Allocation of Resources Without Limits or Throttling