CVE-2026-55734 guardian atom exhaustion in Guardian.Permissions.encode_permissions!/1

Medium 6.9 Published 1 Aug 2026 Updated 3 Aug 2026

An attacker can crash the BEAM node by exhausting the atom table via unvalidated keys in permission maps, affecting Elixir Guardian library users.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2026-55734?

CVE-2026-55734 is a medium-severity denial of service vulnerability in ueberauth guardian, published on 1 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Allocation of Resources Without Limits or Throttling vulnerability in ueberauth guardian (Guardian.Permissions module) allows a denial of service via BEAM atom-table exhaustion.

This vulnerability is associated with program file lib/guardian/permissions.ex and program routines 'Elixir.Guardian.Permissions':encode_permissions!/1, 'Elixir.Guardian.Permissions':encode_permissions_into_claims!/2, 'Elixir.Guardian.Permissions':do_encode_permissions!/2.

The Guardian.Permissions mixin installs a public encode_permissions!/1 function on every module that does use Guardian.Permissions. For each key of the supplied map, encode_permissions!/1 calls String.to_atom(to_string(k)) before any validation runs. The integer-value clause of do_encode_permissions!/2 then short-circuits straight to encoding without validating the key against the configured permission set, so a key with an integer value is interned as a fresh atom with no exception raised. Atoms are never garbage collected and the BEAM atom table is a fixed-size resource (default roughly 1,048,576 entries), so each unique attacker-chosen key permanently consumes one slot. An attacker who can influence a permission map that reaches encode_permissions!/1 (for example a permissions map read from a request body and passed into token issuance via encode_permissions_into_claims!/2) can mint an unbounded number of atoms and exhaust the atom table, crashing the entire BEAM node and every service running on it. The sibling decode_permissions/1 is not affected because it skips keys absent from the configured permission set.

This issue affects guardian: from 2.0.0 before 2.4.1.

Weakness: CWE-770

Which versions are affected by CVE-2026-55734?

1 open source package ship an affected version, including guardian. It affects 1 product.

Package	Affected	Fixed in
`guardian` Hex	From `2.0.0`	`2.4.1`

Products include Ueberauth Guardian.

How do I fix CVE-2026-55734?

Upgrade guardian to 2.4.1 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-55734 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-55734 exists.

Sources

Also known as EEF-CVE-2026-55734, GHSA-9qx2-v587-q3gg.