Denial of Service Vulnerability in Guardian by ueberauth

CVE-2026-55733

What is CVE-2026-55733?

The Guardian library by ueberauth exhibits a vulnerability that allows for Denial of Service through the unrestricted allocation of atoms. Attackers can exploit this weakness by providing arbitrary binary inputs that are processed without proper checks, leading to excessive atom creation. When the encode/3 function is invoked, it directly passes incoming data to String.to_atom/1 without validating against an allow-list, resulting in the potential for an unbounded number of unique atoms to be created. Since atoms in the BEAM virtual machine are never garbage collected and the atom table has a fixed limit, this can lead to exhaustion of resources and crash the entire application stack. It is essential for users running versions from 2.0.0 to prior 2.4.1 to implement the recommended updates to mitigate this risk.

References