guardian (Hex)

Advisories

Latest version

—

License

—

OpenSSF Scorecard

—

How to fix

Upgrading to 2.4.1 or later clears every advisory below that has a fix.

Upgrade commands

mix

{:guardian, "~> 2.4.1"} # then: mix deps.update guardian

Known vulnerabilities

Advisory	Severity	Affected	Fixed in
EEF-CVE-2026-55734 guardian atom exhaustion in Guardian.Permissions.encode_permissions!/1	High EPSS 0.48%	`>= 2.0.0, < 2.4.1`	`2.4.1`
EEF-CVE-2026-55733 Atom-table exhaustion denial of service in Guardian permissions AtomEncoding via unbounded atom creation	High EPSS 0.48%	`>= 2.0.0, < 2.4.1`	`2.4.1`
EEF-CVE-2026-54894 Atom-table exhaustion denial of service in Guardian via unbounded atom creation from binary keys	High EPSS 0.48%	`>= 0.1.0, < 2.4.1`	`2.4.1`
EEF-CVE-2026-55735 Guardian.revoke/3 acts on unverified token claims, allowing forged-token session revocation	High EPSS 0.46%	`>= 1.0.0, < 2.4.1`	`2.4.1`

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor