AIKIDO-2026-458845
guardian is vulnerable to Uncontrolled Resource Consumption
69
CVE Score
Medium
Uncontrolled Resource Consumption
TL;DR
Guardian.Plug.Keys in lib/guardian/plug/keys.ex derives namespace keys by passing arbitrary binaries into String.to_atom with no length, charset, or allow-list check. Higher-level entry points such as Guardian.Plug.current_token thread a caller-supplied key straight into this sink. An application that derives a Guardian key from externally influenced data such as a tenant identifier or request header mints one permanent atom per distinct value, and because the BEAM atom table is fixed in size the node eventually crashes. The fix resolves namespace lookups through String.to_existing_atom and only interns atoms from developer-controlled keys.
How do I fix this?
Upgrade the guardian library to the patch version.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application derives a Guardian namespace key from externally influenced input such as a tenant identifier or request header.
Package
Versions
0.1.0 - 2.4.0
Fixed in 2.4.1Background info
guardian is vulnerable to Uncontrolled Resource Consumption in versions 0.1.0 - 2.4.0.
Links
GitHub Release
Get secure today,
quickly and for free.
Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.
No credit card required | Scan results in 32 seconds.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPAuthorized© All Intel data is openly available and commercially licensed.