PT-2026-67221 · Unknown · Ueberauth Guardian
CVSS v4.0
6.9
Medium
| Vector | AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H |
Name of the Vulnerable Software and Affected Versions
ueberauth guardian versions 0.1.0 through 2.4.0
Description
An allocation of resources without limits or throttling allows a denial of service via unbounded atom creation from attacker-influenced binary input. The
Guardian.Plug.Keys module derives connection and session namespace keys by passing arbitrary binaries to the String.to atom/1 function. Specifically, the base key/1 function in lib/guardian/plug/keys.ex converts binaries into atoms, and the helpers claims key/1, resource key/1, and token key/1 create additional atoms. Similarly, key from other/1 converts regex-captured binaries through String.to atom/1. High-level entry points, such as Guardian.Plug.current token(conn, key: key), pass caller-supplied keys directly into these functions.Because
String.to atom/1 creates a new atom for every unseen binary and atoms are not garbage collected, the BEAM atom table (which has a default limit of approximately 1,048,576 entries) can be exhausted. If an application routes untrusted data, such as a tenant identifier or request header, into a Guardian key via the key parameter, an attacker can send a stream of varied input to consume the atom table and crash the BEAM node, affecting all applications running on it.Recommendations
Update ueberauth guardian to version 2.4.1 or later.
As a temporary workaround, do not derive Guardian keys from untrusted input; instead, use a fixed, hardcoded set of namespace keys or validate values against a bounded allowlist before passing them as the
key option.Exploit
Fix
Allocation of Resources Without Limits
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Ueberauth Guardian