CVE-2026-55733

CVE-2026-55733 is an uncontrolled resource consumption flaw (CWE-770) in the ueberauth Guardian authentication library for Elixir: Guardian.Permissions.AtomEncoding encodes permission scopes by passing each binary in the attacker-supplied scope list to String.to_atom/1 with no allow-list check against the application's defined permission names. Applications that opt into this non-default encoder (via use Guardian.Permissions, encoding: Guardian.Permissions.AtomEncoding) and funnel attacker-influenced strings, such as permission scopes from request bodies or JWT claims, into the encode/3 entry point permanently mint one atom per distinct value, and BEAM atoms are never garbage-collected. Because the Erlang VM's atom table is capped at roughly 1,048,576 entries by default, a modest stream of varied unauthenticated input can exhaust it and crash the BEAM node with a system_limit error, taking down every application running on that node; recovery requires a restart. Only Guardian 2.0.0 through versions before 2.4.1 are affected, and only when the AtomEncoding encoder is explicitly selected, since the default BitwiseEncoding encoder is not affected. A public advisory with a PoC reference exists (GHSA-fjr5-7xrc-hmpj), but there is no confirmed in-the-wild exploitation so far (EPSS 0.3%, not in CISA KEV).

What to do: Upgrade Guardian to 2.4.1 or later. Until then, audit your Guardian configuration for use Guardian.Permissions with encoding: Guardian.Permissions.AtomEncoding and check whether untrusted scope strings reach encode/3; mitigations include switching to the default BitwiseEncoding encoder or validating/allow-listing scope values against your application's known permission names before encoding. Any node that has exhausted its atom table must be restarted to recover.