Guardian's encode_permissions!/1 function allows atom table exhaustion through untrusted permission map keys. This is not a generic 'validate your inputs' advisory—the vulnerability stems from a specific asymmetry between Guardian's encode and decode paths that you cannot discover through normal testing.
The decode path is safe by design: it silently filters out any keys not defined in your configured permission set. The encode path is not. When you pass a map to encode_permissions!/1, every key is interned as a BEAM atom before any validation occurs. An attacker supplying a few thousand unique, unguessable keys across requests will fill the atom table and crash the entire BEAM node—not just your auth service, every process on that runtime.
Worse, there is an integer-value short-circuit in do_encode_permissions!/2 that was intended as an optimization for pre-validated internal keys. This shortcut bypasses the validation that would normally occur, making the encode path particularly dangerous when permission maps are assembled from external sources like database records, external APIs, or request bodies.
If you test your integration using decode (the obvious validation path), you will never discover this edge case. The API contract is silent on this asymmetry, and the vulnerability is invisible at the call site—your auth code passes a map, gets a token back, and the atom allocation cost is deferred and distributed.
Check your codebase for any calls to encode_permissions!/1 where the input map could contain keys from untrusted sources. This includes permission maps assembled from database queries, third-party service responses, or any user-controlled input. The fix in 2.4.1 validates keys before interning them, but note that any atoms already interned during exploitation remain in the atom table permanently—you may need to restart affected nodes to recover full atom table capacity. Given the node-wide blast radius, prioritize patching and audit any multi-tenant deployments where untrusted tenants could supply permission keys.