CVE-2026-55734

CVE-2026-55734 is an allocation-of-resources-without-limits flaw (CWE-770) in the Guardian.Permissions module of the ueberauth guardian Elixir authentication library, affecting versions from 2.0.0 before 2.4.1. The mixin-installed public function encode_permissions!/1 calls String.to_atom(to_string(k)) on every key of the supplied permissions map before any validation runs, and the integer-value clause of do_encode_permissions!/2 short-circuits to encoding without checking the key against the configured permission set, so each unique attacker-chosen key is interned as a fresh BEAM atom. Because atoms are never garbage collected and the BEAM atom table is a fixed-size resource (default roughly 1,048,576 entries), an attacker who can influence a permissions map reaching encode_permissions!/1 or encode_permissions_into_claims!/2 — for example a map read from a request body and passed into token issuance — can mint unbounded atoms, exhaust the table, and crash the entire BEAM node along with every service co-hosted on it. Any Elixir/Erlang application using guardian from 2.0.0 before 2.4.1 that feeds attacker-influenceable data into this encoding path is affected; the sibling decode_permissions/1 is not affected because it skips keys absent from the configured permission set. No exploitation in the wild is currently known (not in CISA KEV; EPSS about 0.3%), but a public advisory with proof-of-concept details exists at GHSA-9qx2-v587-q3gg.

What to do: Upgrade guardian to 2.4.1 or later. Until patched, do not pass attacker-controlled maps directly into encode_permissions!/1 or encode_permissions_into_claims!/2 — validate keys against the configured permission set and cap the number of unique keys first — and monitor atom-table usage (e.g., :erlang.system_info(:atom_count)), since exhaustion takes down the entire BEAM node and all services on it. Note that decode_permissions/1 is unaffected and requires no change.