CVE-2026-55734
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
A vulnerability in the Guardian library (Guardian.Permissions module) allows a denial of service attack via BEAM atom-table exhaustion. The encode_permissions!/1 function converts map keys to atoms without validation, and atoms are never garbage collected, exhausting the fixed-size atom table.
Risk Assessment
An attacker can send a request with arbitrary keys in the permissions map, creating an unbounded number of atoms and crashing the entire BEAM node, halting all services running on it.
Recommendation
Immediately update the Guardian library to version 2.4.1 or later, which includes a fix for this vulnerability.
Other vulnerabilities in Guardian
See all- CVE-2026-34116Critical
A vulnerability in the Guardian language system allows an unauthenticated remote attacker to execute arbitrary OS commands by injecting shell metacharacters into the 'id' parameter in transcribe.php. The parameter is passed directly to the PHP exec() function without any sanitization.
- CVE-2026-34114Critical
The vulnerability in the Guardian language system involves passing the 'id' GET parameter directly into a PHP exec() call in translate_text.php without sanitization. No authentication is required, allowing an unauthenticated remote attacker to execute arbitrary OS commands.
- CVE-2026-34113Critical
A vulnerability in the Guardian language-system allows an unauthenticated attacker to execute arbitrary OS commands remotely by injecting shell metacharacters into the id parameter in speech_text.php.
- CVE-2026-34109Critical
A vulnerability in the Guardian language system allows an unauthenticated attacker to execute arbitrary OS commands remotely by injecting shell metacharacters into the 'id' GET parameter passed directly to the PHP exec() function in speech.php.
- CVE-2026-34108Critical
A vulnerability in the Guardian language-system allows an unauthenticated remote attacker to execute arbitrary OS commands by injecting shell metacharacters into the id parameter, which is passed unsanitized to the exec() function in text.php.
- CVE-2026-34106Critical
A vulnerability in the Guardian language system allows an unauthenticated attacker to execute arbitrary OS commands remotely by injecting shell metacharacters into the 'id' parameter in subtitles.php. The parameter is passed directly to the PHP exec() function without any sanitization.
- CVE-2026-55735High
Improper Verification of Cryptographic Signature in guardian (versions from 1.0.0 before 2.4.1) allows an unauthenticated attacker to revoke a victim's session with a forged JWT token.
- CVE-2026-55733High
A vulnerability in the Guardian library (Elixir) allows DoS via unbounded atom creation from attacker-controlled binary input. The encode/3 function in Guardian.Permissions.AtomEncoding calls String.to_atom/1 without validation, exhausting the BEAM atom table and crashing the node.
- CVE-2026-54894High
Allocation of Resources Without Limits or Throttling in guardian (versions from 0.1.0 before 2.4.1) allows denial of service via unbounded atom creation from attacker-influenced binary input.
Original NVD description (English source)
Allocation of Resources Without Limits or Throttling vulnerability in ueberauth guardian (Guardian.Permissions module) allows a denial of service via BEAM atom-table exhaustion. This vulnerability is associated with program file lib/guardian/permissions.ex and program routines 'Elixir.Guardian.Permissions':encode_permissions!/1, 'Elixir.Guardian.Permissions':encode_permissions_into_claims!/2, 'Elixir.Guardian.Permissions':do_encode_permissions!/2. The Guardian.Permissions mixin installs a public encode_permissions!/1 function on every module that does use Guardian.Permissions. For each key of the supplied map, encode_permissions!/1 calls String.to_atom(to_string(k)) before any validation runs. The integer-value clause of do_encode_permissions!/2 then short-circuits straight to encoding without validating the key against the configured permission set, so a key with an integer value is interned as a fresh atom with no exception raised. Atoms are never garbage collected and the BEAM atom table is a fixed-size resource (default roughly 1,048,576 entries), so each unique attacker-chosen key permanently consumes one slot. An attacker who can influence a permission map that reaches encode_permissions!/1 (for example a permissions map read from a request body and passed into token issuance via encode_permissions_into_claims!/2) can mint an unbounded number of atoms and exhaust the atom table, crashing the entire BEAM node and every service running on it. The sibling decode_permissions/1 is not affected because it skips keys absent from the configured permission set. This issue affects guardian: from 2.0.0 before 2.4.1.