Executive brief
Guardian is an Elixir library used for authentication and authorization in web applications. A vulnerability in its permissions encoding function allows an attacker to exhaust the BEAM virtual machine's fixed atom table by supplying permission maps with arbitrary keys, causing the entire application and any other services running on the same node to crash. This creates a denial-of-service condition that can take down both the affected application and any co-hosted services.
Technical details
The Guardian.Permissions module's encode_permissions!/1 function converts each key in a supplied permission map to an atom via String.to_atom(to_string(k)) without prior validation. When a key has an integer value, the integer-value clause in do_encode_permissions!/2 skips validation and directly encodes the key as a new atom. Since atoms in Erlang's BEAM are never garbage collected and the atom table is a fixed-size resource (default ~1,048,576 entries), each unique attacker-controlled key permanently consumes one table slot. An attacker who can influence permission maps passed to encode_permissions_into_claims!/2 (e.g., from request bodies used in token issuance) can mint unlimited atoms and exhaust the atom table, crashing the entire BEAM node. The decode_permissions function is unaffected because it validates keys against the configured permission set. The vulnerability affects guardian versions 2.0.0 through 2.4.0 and is fixed in 2.4.1.
Affected products
- ueberauth Guardian 2.0.0 through 2.4.0
Timeline
- 2026-08-01: disclosed
- 2026-08-01: patched: Fixed in version 2.4.1