PT-2026-67223 · Unknown · Ueberauth Guardian
CVSS v4.0
6.9
Medium
| Vector | AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H |
Name of the Vulnerable Software and Affected Versions
ueberauth guardian versions 2.0.0 through 2.4.0
Description
An allocation of resources without limits or throttling allows a denial of service via unbounded atom creation from attacker-controlled binary input. The
Guardian.Permissions.AtomEncoding encoder processes permission scopes by passing arbitrary binaries to the String.to atom/1 function. When the encode/3 function in lib/guardian/permissions/atom encoding.ex is called with a list, the encode value/3 binary clause calls String.to atom(value) without an allow-list check, discarding the perm set argument.Because
String.to atom/1 creates a new atom for every unseen binary and atoms are not garbage collected, the BEAM atom table (limited to approximately 1,048,576 entries) can be exhausted. An attacker providing varied input through request bodies or JWT claims can trigger a system limit crash of the BEAM node, affecting all applications running on it.Recommendations
Update ueberauth guardian to version 2.4.1 or later.
As a temporary workaround, switch the permission encoder to
Guardian.Permissions.BitwiseEncoding or Guardian.Permissions.TextEncoding.
As a temporary workaround, validate every permission value against the configured perm set allowlist before passing it to the encode/3 function.Exploit
Fix
Allocation of Resources Without Limits
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Ueberauth Guardian