CVE-2026-55733 Ueberauth CVE debrief

Who should care

Users of ueberauth guardian, especially those who use Guardian.Permissions.AtomEncoding, should be aware of this vulnerability and take steps to remediate it. This includes updating guardian to version 2.4.1 or later, using the default encoder Guardian.Permissions.BitwiseEncoding, monitoring for suspicious activity, and implementing compensating controls. Additionally, users should perform inventory checks for affected versions and track exceptions and retest after remediation. The vulnerability has a CVSS score of 6.9 and a MEDIUM severity level, indicating a moderate level of risk. Therefore, users should prioritize remediation efforts accordingly. Affected users should also review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Compensating controls for exposed systems should be reviewed while remediation is scheduled and verified. Relevant monitoring, detection, and logs for exposed assets should be checked for extra review. Exceptions should be tracked, and remediated assets should be retested and closed only after evidence is documented. This vulnerability can be mitigated by Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. This can be done by reviewing the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Planning vendor-supported updates or mitigations through normal change control where exposure is confirmed can also mitigate this vulnerability. Compensating controls for exposed systems should be reviewed while remediation is scheduled and verified. Checking relevant monitoring, detection, and logs for exposed assets that need extra review can also help. Tracking exceptions, retesting remediated assets, and closing the item only after evidence is documented is also recommended. The CVE record was published on 2026-08-01T19:16:42.157Z and has not been modified since then. Therefore, users should rely on the information provided in the CVE record and take necessary actions to remediate the vulnerability. The vulnerability can cause denial of service via unbounded atom creation from attacker-

Technical summary

The CVE is caused by the Allocation of Resources Without Limits or Throttling in ueberauth guardian, which allows denial of service via unbounded atom creation from attacker-controlled binary input. The Guardian.Permissions.AtomEncoding encodes permission scopes by passing arbitrary binaries to String.to_atom/1, leading to potential atom table exhaustion. This issue affects guardian: from 2.0.0 before 2.4.1. The default encoder is Guardian.Permissions.BitwiseEncoding, which is not affected. Users of ueberauth guardian, especially those who use Guardian.Permissions.AtomEncoding, should be aware of this vulnerability and take steps to remediate it.

Defensive priority

Medium priority given the CVSS score of 6.9 and the potential for denial of service attacks.

Recommended defensive actions

• Update guardian to version 2.4.1 or later
• Use the default encoder Guardian.Permissions.BitwiseEncoding
• Monitor for suspicious activity and implement compensating controls
• Perform inventory checks for affected versions
• Exception tracking and retest after remediation

Evidence notes

The CVE is caused by the Allocation of Resources Without Limits or Throttling in ueberauth guardian, which allows denial of service via unbounded atom creation from attacker-controlled binary input. The Guardian.Permissions.AtomEncoding encodes permission scopes by passing arbitrary binaries to String.to_atom/1, leading to potential atom table exhaustion.

Official resources