Executive brief
Guardian is a widely-used authentication library for Elixir applications. The library converts user-supplied input (such as tenant identifiers or request headers) directly into atoms without bounds, and atoms are never garbage-collected in the Erlang BEAM runtime. An attacker can exhaust the fixed atom table with a modest stream of varied requests, crashing the entire application and any other services running on the same BEAM node.
Technical details
Guardian.Plug.Keys functions (base_key/1, claims_key/1, resource_key/1, token_key/1, and key_from_other/1) pass attacker-controlled binary input directly to String.to_atom/1 to derive session and connection namespace keys. The public API advertises String.t() as valid input, and higher-level functions like Guardian.Plug.current_token/2 thread caller-supplied keys directly through these vulnerable functions. Each distinct binary input creates a permanent atom that is never garbage-collected; the BEAM atom table is fixed at approximately 1,048,576 entries by default. An unauthenticated attacker routing varied input through a Guardian key parameter can mint one permanent atom per distinct value, exhaust the atom table, and trigger a denial of service. The vulnerability affects guardian versions 0.1.0 through 2.4.0; version 2.4.1 and later contain a fix.
Affected products
- ueberauth Guardian 0.1.0 through 2.4.0
Timeline
- 2026-08-01: disclosed
- 2026-08: patched: Version 2.4.1 and later contain a fix