AIKIDO-2026-110518
guardian is vulnerable to Uncontrolled Resource Consumption
69
Medium Risk
This Affects:
guardianTL;DR
The encode_permissions!/1 function generated by use Guardian.Permissions in lib/guardian/permissions.ex calls String.to_atom on every key of the supplied map before validating it against the configured permission set. Keys with integer values skip validation entirely, so unknown keys are interned as new atoms with no error raised. Because BEAM atoms are never garbage collected and the atom table is a fixed-size resource, an application that passes an externally influenced permissions map into token issuance lets a single request mint unbounded atoms and crash the node. The fix validates keys against the permission set and resolves lookups through String.to_existing_atom.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application routes externally influenced permission maps into encode_permissions!/1 or encode_permissions_into_claims!/2.
Background info
guardian is vulnerable to Uncontrolled Resource Consumption in versions 2.0.0 - 2.4.0.
How to fix this
Upgrade the guardian library to the patch version.
Links
GitHub Release
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant