CVE-2026-54894

Summary: CVE-2026-54894 describes an atom-table exhaustion denial of service in the Elixir Guardian library (Guardian.Plug.Keys) caused by unbounded calls to String.to_atom/1 when deriving keys from attacker-controlled input. What is affected: ueberauth guardian versions 0.1.0 through 2.4.0. The ...

CVE-2026-54894 Atom-table exhaustion denial of service in Guardian via unbounded atom creation from binary keys

Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom creation from attacker-influenced binary input. Guardian.Plug.Keys derives connection and session namespace keys by passing arbitrary binaries to String.toatom/1. basekey/1 in...

CVE-2026-54894 Atom-table exhaustion denial of service in Guardian via unbounded atom creation from binary keys

Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom creation from attacker-influenced binary input. Guardian.Plug.Keys derives connection and session namespace keys by passing arbitrary binaries to String.toatom/1. basekey/1 in...