OpenID Connect client Atom Exhaustion in provider configuration worker ets table location in oidcc
Summary
CVE-2024-31209: OpenID Connect client Atom Exhaustion in provider configuration worker ets table location. Affects oidcc across 3 version ranges.
>= 3.0.0, < 3.0.2
>= 3.1.0, < 3.1.2
>= 3.2.0-beta.1, < 3.2.0-beta.3
Fixed in 3.0.2, 3.1.2 or 3.2.0-beta.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
oidcc is an OpenID Connect client library for Erlang. It provides functionality for retrieving user information from an OpenID Connect provider. The library uses an ETS table to store provider configurations. This vulnerability affects the provider configuration worker ETS table location in oidcc.
Vulnerability Detail
The vulnerability allows for denial of service (DOS) attacks by exhausting atoms. By calling certain functions in the oidcc library, such as oidcc_provider_configuration_worker:get_provider_configuration/1 or oidcc_provider_configuration_worker:get_jwks/1, an attacker can trigger atom exhaustion. This occurs when the atom table fills up with different atoms each time the vulnerable function is called, potentially leading to a crash of the Erlang node. However, the likelihood of exploitation is low, as the name argument is typically a static value in applications using oidcc.
How To Fix
Latest published version: 3.9.0 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 3.0.0, < 3.0.23.0.2 -
>= 3.1.0, < 3.1.23.1.2 -
>= 3.2.0-beta.1, < 3.2.0-beta.33.2.0-beta.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
To mitigate the risk of atom exhaustion, ensure that only valid provider configuration worker names are passed to the vulnerable functions in oidcc.
Conclusion
The OpenID Connect client library oidcc is vulnerable to atom exhaustion in the provider configuration worker ETS table location. While the impact of this vulnerability is moderate, the likelihood of exploitation is low. It is recommended to update the oidcc library to one of the patched versions to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for oidcc →
FAQ
oidcc is an OpenID Connect client library for Erlang.
The vulnerable functions are oidcc_provider_configuration_worker:get_provider_configuration/1 and oidcc_provider_configuration_worker:get_jwks/1.
Atom exhaustion occurs when the atom table fills up with different atoms, potentially leading to a crash of the Erlang node.
The likelihood of exploitation is low, as the name argument is typically a static value in applications using oidcc.
Update the oidcc library to one of the patched versions: 3.0.2, 3.1.2, or 3.2.0-beta.3.
References
Related vulnerabilities
Recent vulnerabilities recorded for oidcc.
