CVE-2026-54894
Atom-table exhaustion denial of service in Guardian via unbounded atom creation from binary keys
Description
Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom creation from attacker-influenced binary input. Guardian.Plug.Keys derives connection and session namespace keys by passing arbitrary binaries to String.to_atom/1. base_key/1 in lib/guardian/plug/keys.ex converts any binary into the atom :"guardian_<input>", and the derived helpers claims_key/1, resource_key/1, and token_key/1 create a second atom on top of that. key_from_other/1 likewise converts a regex-captured binary through String.to_atom/1. The public specs advertise String.t() as a valid argument, so passing a string is documented usage, and higher-level entry points such as Guardian.Plug.current_token(conn, key: key) thread the caller-supplied key straight into these functions. String.to_atom/1 creates a brand-new atom for every previously unseen binary, atoms are never garbage collected, and the BEAM atom table is fixed at roughly 1,048,576 entries by default. An application that routes attacker-influenced data (a tenant identifier, header, or other request input) into a Guardian key therefore mints one permanent atom per distinct value. A modest stream of varied, unauthenticated input permanently consumes the atom table and crashes the BEAM node, taking down every application running on it. This issue affects guardian: from 0.1.0 before 2.4.1.
INFO
Published Date :
Aug. 1, 2026, 7:16 p.m.
Last Modified :
Oct. 23, 2026, 10:10 p.m.
Remotely Exploit :
Yes !
Source :
6b3ad84c-e1a6-4bf7-a703-f496b71e49db
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | HIGH | [email protected] | ||||
| CVSS 4.0 | MEDIUM | 6b3ad84c-e1a6-4bf7-a703-f496b71e49db | ||||
| CVSS 4.0 | MEDIUM | 6b3ad84c-e1a6-4bf7-a703-f496b71e49db |
Solution
- Update Guardian to version 2.4.1 or newer.
- Review and sanitize binary inputs used for key generation.
- Implement limits on atom creation or input length.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-54894.
| URL | Resource |
|---|---|
| https://cna.erlef.org/cves/CVE-2026-54894.html | Third Party Advisory |
| https://github.com/ueberauth/guardian/commit/2952657e42e6341a67e6aaad09d8f0b40ae917cb | Patch |
| https://github.com/ueberauth/guardian/security/advisories/GHSA-xqch-c77q-rgh5 | Exploit Patch Vendor Advisory |
| https://osv.dev/vulnerability/EEF-CVE-2026-54894 | Third Party Advisory |
| https://github.com/ueberauth/guardian/security/advisories/GHSA-xqch-c77q-rgh5 | Exploit Patch Vendor Advisory |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-54894 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-54894
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-54894 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-54894 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 23, 2026
Action Type Old Value New Value Added Translation Title: guardian de ueberauth, Description: La asignación de recursos sin límites ni estrangulamiento en ueberauth guardian permite la denegación de servicio a través de la creación ilimitada de átomos a partir de entrada binaria influenciada por el atacante. Guardian.Plug.Keys deriva claves de espacio de nombres de conexión y de sesión pasando binarios arbitrarios a String.to_atom/1. base_key/1 en lib/guardian/plug/keys.ex convierte cualquier binario en el átomo :“guardian_[input]”, y las funciones auxiliares derivadas claims_key/1, resource_key/1 y token_key/1 crean un segundo átomo además de eso. key_from_other/1 de manera similar convierte un binario capturado por regex a través de String.to_atom/1. Las especificaciones públicas anuncian String.t() como un argumento válido, por lo que pasar una cadena es un uso documentado, y los puntos de entrada de nivel superior, como Guardian.Plug.current_token(conn, key: key), pasan la clave proporcionada por el llamador directamente a estas funciones. String.to_atom/1 crea un átomo completamente nuevo para cada binario no visto anteriormente, los átomos nunca son recolectados por el recolector de basura, y la tabla de átomos de BEAM está fijada en aproximadamente 1.048.576 entradas por defecto. Una aplicación que enruta datos influenciados por el atacante (un identificador de inquilino, encabezado u otra entrada de solicitud) en una clave de Guardian, por lo tanto, acuña un átomo permanente por cada valor distinto. Un flujo modesto de entrada variada y no autenticada consume permanentemente la tabla de átomos y bloquea el nodo BEAM, derribando todas las aplicaciones que se ejecutan en él. Este problema afecta a guardian: desde 0.1.0 antes de 2.4.1. -
Initial Analysis by [email protected]
Aug. 06, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Added CPE Configuration OR *cpe:2.3:a:ueberauth:guardian:*:*:*:*:*:*:*:* versions up to (excluding) 2.4.1 Added Reference Type CISA-ADP: https://github.com/ueberauth/guardian/security/advisories/GHSA-xqch-c77q-rgh5 Types: Exploit, Patch, Vendor Advisory Added Reference Type EEF: https://cna.erlef.org/cves/CVE-2026-54894.html Types: Third Party Advisory Added Reference Type EEF: https://github.com/ueberauth/guardian/commit/2952657e42e6341a67e6aaad09d8f0b40ae917cb Types: Patch Added Reference Type EEF: https://github.com/ueberauth/guardian/security/advisories/GHSA-xqch-c77q-rgh5 Types: Exploit, Patch, Vendor Advisory Added Reference Type EEF: https://osv.dev/vulnerability/EEF-CVE-2026-54894 Types: Third Party Advisory -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Aug. 03, 2026
Action Type Old Value New Value Added Reference https://github.com/ueberauth/guardian/security/advisories/GHSA-xqch-c77q-rgh5 Added SSVC {'id': 'CVE-2026-54894', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'poc'}, {'automatable': 'no'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-08-03T17:49:32.217048Z'} -
New CVE Received by 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
Aug. 01, 2026
Action Type Old Value New Value Added Affected [{'cpes': ['cpe:2.3:a:ueberauth:guardian:*:*:*:*:*:*:*:*'], 'repo': 'https://github.com/ueberauth/guardian', 'vendor': 'ueberauth', 'modules': ["'Elixir.Guardian.Plug.Keys'"], 'product': 'guardian', 'versions': [{'status': 'affected', 'version': '0.1.0', 'lessThan': '2.4.1', 'versionType': 'semver'}], 'packageURL': 'pkg:hex/guardian', 'packageName': 'guardian', 'programFiles': ['lib/guardian/plug/keys.ex'], 'collectionURL': 'https://repo.hex.pm', 'defaultStatus': 'unaffected', 'programRoutines': [{'name': "'Elixir.Guardian.Plug.Keys':base_key/1"}, {'name': "'Elixir.Guardian.Plug.Keys':claims_key/1"}, {'name': "'Elixir.Guardian.Plug.Keys':resource_key/1"}, {'name': "'Elixir.Guardian.Plug.Keys':token_key/1"}, {'name': "'Elixir.Guardian.Plug.Keys':key_from_other/1"}]}, {'cpes': ['cpe:2.3:a:ueberauth:guardian:*:*:*:*:*:*:*:*'], 'repo': 'https://github.com/ueberauth/guardian', 'vendor': 'ueberauth', 'modules': ["'Elixir.Guardian.Plug.Keys'"], 'product': 'guardian', 'versions': [{'status': 'affected', 'version': '7126fa433afc2563fcac0c9aa35193965f8fd5f8', 'lessThan': '2952657e42e6341a67e6aaad09d8f0b40ae917cb', 'versionType': 'git'}], 'packageURL': 'pkg:github/ueberauth/guardian', 'packageName': 'ueberauth/guardian', 'programFiles': ['lib/guardian/plug/keys.ex'], 'collectionURL': 'https://github.com', 'defaultStatus': 'unaffected', 'programRoutines': [{'name': "'Elixir.Guardian.Plug.Keys':base_key/1"}, {'name': "'Elixir.Guardian.Plug.Keys':claims_key/1"}, {'name': "'Elixir.Guardian.Plug.Keys':resource_key/1"}, {'name': "'Elixir.Guardian.Plug.Keys':token_key/1"}, {'name': "'Elixir.Guardian.Plug.Keys':key_from_other/1"}]}] Added Description Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom creation from attacker-influenced binary input. Guardian.Plug.Keys derives connection and session namespace keys by passing arbitrary binaries to String.to_atom/1. base_key/1 in lib/guardian/plug/keys.ex converts any binary into the atom :"guardian_<input>", and the derived helpers claims_key/1, resource_key/1, and token_key/1 create a second atom on top of that. key_from_other/1 likewise converts a regex-captured binary through String.to_atom/1. The public specs advertise String.t() as a valid argument, so passing a string is documented usage, and higher-level entry points such as Guardian.Plug.current_token(conn, key: key) thread the caller-supplied key straight into these functions. String.to_atom/1 creates a brand-new atom for every previously unseen binary, atoms are never garbage collected, and the BEAM atom table is fixed at roughly 1,048,576 entries by default. An application that routes attacker-influenced data (a tenant identifier, header, or other request input) into a Guardian key therefore mints one permanent atom per distinct value. A modest stream of varied, unauthenticated input permanently consumes the atom table and crashes the BEAM node, taking down every application running on it. This issue affects guardian: from 0.1.0 before 2.4.1. Added CVSS V4.0 AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CWE CWE-770 Added Reference https://cna.erlef.org/cves/CVE-2026-54894.html Added Reference https://github.com/ueberauth/guardian/commit/2952657e42e6341a67e6aaad09d8f0b40ae917cb Added Reference https://github.com/ueberauth/guardian/security/advisories/GHSA-xqch-c77q-rgh5 Added Reference https://osv.dev/vulnerability/EEF-CVE-2026-54894