CVE-2026-55734 ueberauth CVE debrief

Who should care

Users of ueberauth guardian versions from 2.0.0 before 2.4.1 should be aware of this vulnerability and take steps to mitigate it. This includes administrators and security teams responsible for the affected systems, as well as developers who may need to apply patches or implement compensating controls. Additionally, operators and platform teams may need to review and update their configurations to prevent exploitation. Vulnerability management and security teams should prioritize this issue given its potential impact on system availability and security posture. They should also ensure that monitoring and detection mechanisms are in place to identify potential exploitation attempts. Asset owners and change management teams may also need to be involved in the remediation process to ensure that affected systems are properly updated or mitigated. Overall, a coordinated effort across multiple teams may be necessary to fully address this vulnerability. The CVSS score of 6.9 indicates a medium severity, but the potential for denial of service via atom-table exhaustion makes it a significant concern for affected systems. Therefore, it is essential to assess the risk and implement measures to prevent exploitation in a timely manner. This may involve reviewing system configurations, applying patches, and implementing compensating controls such as monitoring and access restrictions. By taking proactive steps, organizations can minimize the risk associated with this vulnerability and maintain the security and availability of their systems. To verify the vulnerability and assess the risk, defenders should review the official advisory and CVE record, and check for any unusual activity in system logs. They should also consider applying the vendor's remediation for this vulnerability and implementing additional security measures to prevent exploitation. Furthermore, defenders should be aware of the potential for attackers to exploit this vulnerability and take steps to prevent it, such as restricting access to the affected module and monitoring for suspicious activity. By being proactive and taking steps to mitigate this vulnerability, organizations can reduce the risk of a Den

Technical summary

The Guardian.Permissions mixin installs a public encode_permissions!/1 function on every module that does use Guardian.Permissions. For each key of the supplied map, encode_permissions!/1 calls String.to_atom(to_string(k)) before any validation runs. The integer-value clause of do_encode_permissions!/2 then short-circuits straight to encoding without validating the key against the configured permission set, so a key with an integer value is interned as a fresh atom with no exception raised. Atoms are never garbage collected and the BEAM atom table is a fixed-size resource (default roughly 1,048,576 entries), so each unique attacker-chosen key permanently consumes one slot.

Defensive priority

Medium priority given the CVSS score of 6.9 and the potential for denial of service via atom-table exhaustion.

Recommended defensive actions

• Inventory and verify the version of ueberauth guardian in use and upgrade to version 2.4.1 or later if vulnerable.
• Implement compensating controls such as monitoring for unusual activity and restricting access to the affected module.
• Consider applying the vendor's remediation for this vulnerability.
• Review system configurations and apply patches or mitigations through normal change control.
• Monitor for suspicious activity and review relevant logs for exposed assets.
• Track exceptions and retest remediated assets to ensure vulnerability is resolved.
• Verify that compensating controls are in place for exposed systems while remediation is scheduled.

Evidence notes

The vulnerability is caused by the Allocation of Resources Without Limits or Throttling in the Guardian.Permissions module of ueberauth guardian, which allows a denial of service via BEAM atom-table exhaustion. The issue affects guardian from 2.0.0 before 2.4.1.

Official resources