AIKIDO-2026-634688
guardian is vulnerable to Uncontrolled Resource Consumption
69
Medium Risk
This Affects:
guardianTL;DR
The optional Guardian.Permissions.AtomEncoding encoder in lib/guardian/permissions/atom_encoding.ex converts permission scopes into atoms by calling String.to_atom on arbitrary binaries and ignores the application's permission allow-list. An application that opts into this encoder and feeds it externally influenced permission scopes interns one permanent atom per distinct value. Because BEAM atoms are never garbage collected and the atom table is fixed in size, a stream of varied unauthenticated input exhausts the table and crashes the node. The fix validates each value against the permission set and uses String.to_existing_atom instead of minting fresh atoms.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application opts into the Guardian.Permissions.AtomEncoding encoder and passes externally influenced permission scopes into it.
Background info
guardian is vulnerable to Uncontrolled Resource Consumption in versions 2.0.0 - 2.4.0.
How to fix this
Upgrade the guardian library to the patch version.
Links
GitHub Release
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant