Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
ueberauth guardian — guardian atom exhaustion in Guardian.Permissions.encode_permissions!/1
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV
L L P N N N N H 6.9 .0029 21.2 —
AFFECTED
Product Versions Fixed
guardian 2.0.0 – —
guardian b7a6128ca4d0ffb7f7df5219dd982304ff9d6802 – —
TIMELINE
Jun 17 Reserved by EEF
Aug 1 EXPLOIT PUBLISHED — CVE-2026-55734 (ueberauth guardian). Public exploit reference added.
Aug 1 Published (CNA: EEF)
Aug 6 EXPLOIT PUBLISHED — CVE-2026-55734 (ueberauth guardian). Public exploit reference added.
Description
Allocation of Resources Without Limits or Throttling vulnerability in ueberauth guardian (Guardian.Permissions module) allows a denial of service via BEAM atom-table exhaustion.
This vulnerability is associated with program file lib/guardian/permissions.ex and program routines 'Elixir.Guardian.Permissions':encode_permissions!/1, 'Elixir.Guardian.Permissions':encode_permissions_into_claims!/2, 'Elixir.Guardian.Permissions':do_encode_permissions!/2.
The Guardian.Permissions mixin installs a public encode_permissions!/1 function on every module that does use Guardian.Permissions. For each key of the supplied map, encode_permissions!/1 calls String.to_atom(to_string(k)) before any validation runs. The integer-value clause of do_encode_permissions!/2 then short-circuits straight to encoding without validating the key against the configured permission set, so a key with an integer value is interned as a fresh atom with no exception raised. Atoms are never garbage collected and the BEAM atom table is a fixed-size resource (default roughly 1,048,576 entries), so each unique attacker-chosen key permanently consumes one slot. An attacker who can influence a permission map that reaches encode_permissions!/1 (for example a permissions map read from a request body and passed into token issuance via encode_permissions_into_claims!/2) can mint an unbounded number of atoms and exhaust the atom table, crashing the entire BEAM node and every service running on it. The sibling decode_permissions/1 is not affected because it skips keys absent from the configured permission set.
This issue affects guardian: from 2.0.0 before 2.4.1.
Lifecycle
Complete event history — 4 events, chronological
| Date | Event | Detail |
|---|
| June 17, 2026 | Reserved | Reserved by EEF |
| August 1, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-55734 (ueberauth guardian). Public exploit reference added. |
| August 1, 2026 | Published | Published (CNA: EEF) |
| August 6, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-55734 (ueberauth guardian). Public exploit reference added. |
Affected
Affected products and packages — 2 rows
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| ueberauth | guardian | — | 2.0.0 | — |
| ueberauth | guardian | — | b7a6128ca4d0ffb7f7df5219dd982304ff9d6802 | — |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-55734 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.