What is the official website of Arrow Systems Integration ?

The official website of Arrow Systems Integration is http://www.arrowsi.com/.

What is Arrow Systems Integration's cybersecurity risk score?

Arrow Systems Integration has an AI-generated cybersecurity risk score of 754 out of 1000, indicating a Fair security posture according to Rankiteo's assessment.

How many security incidents has Arrow Systems Integration experienced?

According to Rankiteo, Arrow Systems Integration currently holds 0 security badges, indicating that no recognized compliance certifications are currently verified for the organization.

Has Arrow Systems Integration been affected by any supply chain cyber incidents ?

According to Rankiteo, Arrow Systems Integration has not been affected by any supply chain cyber incidents, and no incident IDs are currently listed for the organization.

Does Arrow Systems Integration have SOC 2 Type 1 certification ?

According to Rankiteo, Arrow Systems Integration is not certified under SOC 2 Type 1.

Does Arrow Systems Integration have SOC 2 Type 2 certification ?

According to Rankiteo, Arrow Systems Integration does not hold a SOC 2 Type 2 certification.

Does Arrow Systems Integration comply with GDPR ?

According to Rankiteo, Arrow Systems Integration is not listed as GDPR compliant.

Does Arrow Systems Integration have PCI DSS certification ?

According to Rankiteo, Arrow Systems Integration does not currently maintain PCI DSS compliance.

Does Arrow Systems Integration comply with HIPAA ?

According to Rankiteo, Arrow Systems Integration is not compliant with HIPAA regulations.

Does Arrow Systems Integration have ISO 27001 certification ?

According to Rankiteo,Arrow Systems Integration is not certified under ISO 27001, indicating the absence of a formally recognized information security management framework.

Which industry does Arrow Systems Integration operate in ?

Arrow Systems Integration operates primarily in the Telecommunications industry.

How many employees does Arrow Systems Integration have ?

Arrow Systems Integration employs approximately 144 people worldwide.

Does Arrow Systems Integration own any subsidiaries ?

Arrow Systems Integration presently has no subsidiaries across any sectors.

How many LinkedIn followers does Arrow Systems Integration have ?

Arrow Systems Integration's official LinkedIn profile has approximately 1,829 followers.

What is the NAICS classification code for Arrow Systems Integration ?

Arrow Systems Integration is classified under the NAICS code 517, which corresponds to Telecommunications.

Does Arrow Systems Integration have a Crunchbase profile ?

No, Arrow Systems Integration does not have a profile on Crunchbase.

Does Arrow Systems Integration have a LinkedIn profile ?

Yes, Arrow Systems Integration maintains an official LinkedIn profile, which is actively utilized for branding and talent engagement, which can be accessed here: https://www.linkedin.com/company/arrow-systems-integration.

How many cybersecurity incidents has Arrow Systems Integration experienced ?

As of August 2, 2026, Rankiteo reports that Arrow Systems Integration has experienced 1 cybersecurity incidents.

How many peer or competitor companies does Arrow Systems Integration have ?

Arrow Systems Integration has an estimated 10,260 peer or competitor companies worldwide.

What types of cybersecurity incidents has Arrow Systems Integration faced ?

Incident Types: The types of cybersecurity incidents that have occurred include Breach.

NEWRankiteo Cyber Underwriting Desktop - Score, price, and bind from your desktop

WindowsmacOSLinux

Download

Badge your company to reduce your risk score and your cyber insurance costs!

Link verified badges to your company page to build trust with insurers and customers.

Apply now and get your badge!

Internal validation & live display

Insurers and partners see a safer profile

Faster underwriting decisions

Trusted by insurers. Chosen by leaders.

Proud contributor to the Society of Actuaries.

ASI

Boost Score +25 with badge (5 left)

754

/1000

Fair

779

/1000

Fair

Arrow Systems Integration Vendor Cyber Rating & Cyber Score

arrowsi.com

Add Your Compliance Badge

Our long-term partnerships with the leading manufacturers of voice and data technology in North America enable us to recommend proven, business transforming solutions including unified communications, voice and data technologies, contact center and network security. We believe that a company's growth and profitability should be built upon a foundation of employee empowerment and a commitment to the customer and we continue in our legacy of making communications technology the best it can be through unmatched technical expertise and depth. Whether educating clients on the latest technology, implementing a solution or providing consultative services, Arrow Systems Integration (Arrow SI) offers the products, solutions and industry experts

ASI A.I CyberSecurity Scoring

Scoring History

ASI

Arrow Systems Integration CyberSecurity News & History

Past Incidents

Attack Types

Entity

Type

Severity

Impact

Seen

Blog Details

Supply Chain Source

Incident Details

View

Arrow Systems Integ...

Breach

2/2010

ARR408070825

Loading…

A.I.

ASI Company Scoring based on AI Models

Cyber Incidents Likelihood 3 - 6 - 9 months

Actual

Prediction

Incident Predictions locked

Access Monitoring Plan

A.I Risk Score Likelihood 3 - 6 - 9 months

Actual

Prediction A

Prediction B

Prediction C

Prediction D

A.I. Risk Score Predictions locked

Access Monitoring Plan

Loading…

Underwriter Stats for ASI

Incidents vs Telecommunications Industry Avg (This Year)

No incidents recorded for Arrow Systems Integration in 2026.

Incidents vs All-Companies Average (This Year)

No incidents recorded for Arrow Systems Integration in 2026.

Incident Types ASI vs Telecommunications Industry Avg (This Year)

No incidents recorded for Arrow Systems Integration in 2026.

Incident History - ASI (X = Date, Y = Severity)

Loading…

SUBSIDIARY

Arrow Systems Integration Subsidiaries

ASI

Telecommunications

Website: http://www.arrowsi.com/

Company Size: 1,001-5,000 employees

Arrow ElectronicsTechnology, Information and Internet

SiliconExpertTechnology, Information and Internet

SiliconExpert GermanyIT Services and IT Consulting

SiliconExpert ItalyIT Services and IT Consulting

SiliconExpert FranceIT Services and IT Consulting

ConvergeSemiconductor Manufacturing

Converge FOMComputer Hardware Manufacturing

Arrow ECS EMEAInformation Technology & Services

Arrow ECS End User ComputingIT Services and IT Consulting

Arrow ECS FranceIT Services and IT Consulting

Arrow Security SolutionsIT Services and IT Consulting

Arrow ECS SpainIT Services and IT Consulting

Arrow ECS United KingdomInformation Technology & Services

The IT InsiderIT Services and IT Consulting

Arrow Cloud UK & IrelandIT Services and IT Consulting

Arrow ECS North AmericaIT Services and IT Consulting

immixGroupIT Services and IT Consulting

Arrow Electronics ItaliaIT Services and IT Consulting

Arrow ECS SwedenIT Services and IT Consulting

Arrow ECS Education SwedenIT-tjänster och IT-konsulttjänster

Richardson RFPDSemiconductor Manufacturing

Richardson RFPD Global IoT SolutionsWireless Services

Arrow Intelligent SolutionsInformation Technology & Services

Arrow ECS DenmarkInformation Technology & Services

Arrow ECS Education - DenmarkInformation Technology & Services

Arrow ECS AustriaComputer and Network Security

Arrow ECS ANZIT Services and IT Consulting

Arrow ECS CloudIT Services and IT Consulting

Arrow Asia Pac LtdIT Services and IT Consulting

Arrow ECS Norway ASIT Services and IT Consulting

Arrow ECS Education NorwayIT-tjenester og -rådgivning

Arrow ECS PortugalInformation Technology & Services

Arrow ECS BeLuxInformation Technology & Services

Arrow BeLux - IBM FlashSystemIT Services and IT Consulting

Arrow Aerospace and Defense | Zeus & A.E. PetscheAviation and Aerospace Component Manufacturing

NIC Components Corp.Appliances, Electrical, and Electronics Manufacturing

Arrow NederlandIT Services and IT Consulting

A.E. PetscheDefense and Space Manufacturing

Arrow ECS PolskaIT Services and IT Consulting

Arrow Electronics IberiaSemiconductor Manufacturing

VericalAppliances, Electrical, and Electronics Manufacturing

Arrow ECS Finland OyIT Services and IT Consulting

Arrow vLounge FinlandInformation Technology & Services

Arrow Electronics TürkiyeToptan Satış Beyaz Eşya, Elektrikli ve Elektrik ve Elektronik Eşya

Arrow ECS Moroccoالخدمات والاستشارات في مجال تكنولوجيا المعلومات

Arrow ECS HungaryIT Services and IT Consulting

Transim TechnologySoftware Development

Arrow ECS Czech RepublicIT Services and IT Consulting

Arrow ECS Education Czech RepublicIT služby a IT poradenství

Arrow ECS Education ServicesIT Services and IT Consulting

Loading…

Arrow Systems Integration Similar Companies

Telstra

telstra.com.au

We believe it’s people who give purpose to our technology. So we’re committed to staying close to our customers and providing them the best experience. And delivering the best tech. On the best network. Because our purpose is to build a connected future so everyone can thrive. We build technology and content solutions that are simple and easy to use, including Australia’s largest and fastest national mobile network. That’s why we strive to serve and know our customers better than anyone else – offering a choice of not just digital connection, but digital content as well. And that’s why we have an international presence spanning 15 countries, including China. In the 21st century, opportunity belongs to connected businesses, governments, communities and individuals. As Australia’s leading telecommunications and information services company, Telstra is proud to be helping our customers improve the ways in which they live and work through connection. Be first to know about Telstra news, advice and offers, as well as updates on our people and partners: tel.st/subscribe

Ciena

cb ciena.com

Ciena (NYSE:CIEN) is the global leader in high-speed connectivity. We build advanced networks to support exponential growth in bandwidth demand—empowering our customers, partners, and communities to thrive in the AI era. With unparalleled expertise and innovation, our networking systems, interconnects, automation software, and services revolutionize data transmission and network management.

Proximus Group

proximus.com

Proximus Group is a provider of future-proof connectivity, IT and digital services, headquartered in Brussels. The Group is actively engaged in building a connected world that people trust, so society blooms. The Domestic segment is focused on providing state-of-the art telecommunications and IT services in the Benelux. In Belgium, core products and services are offered under the Proximus, Mobile Vikings and Scarlet brands for the residential market and Proximus NXT for the Enterprise market. The Group is also active in the Netherlands and in Luxembourg (Tango and Proximus NXT). Proximus Global overarches the international activities of the Group, gathering the strengths of BICS, Telesign and Route Mobile. Encompassing the entire value chain from P2P Voice & Messaging and Mobility services to CPaaS and Digital Identity, Proximus Global is in a unique position to become a global digital communications leader. The Group has the ambition to build the #1 gigabit network for Belgium and plays a central role in creating inspiring digital ecosystems, while fostering an engaging culture and empowering ways of working. Building upon these strengths, Proximus aims to contribute to an inclusive and sustainable digital society, delight customers with an unrivalled experience and achieve profitable growth both locally and internationally to deliver long-term value for stakeholders. With 13,131 employees, imbued with Proximus' Think Possible mindset and all engaged to offer a superior customer experience, the Group realized an underlying Group revenue of EUR 6,430 million end-2024.

Optus

optus.com.au

Optus is an Australian telecommunications company, delivering more than 11 million services to our customers every day across mobile, broadband and digital solutions. Message our dedicated Social Media Care team at help.optus.com.au/contactus for 24/7 assistance with your account. You can also visit our Contact Us page for other ways to get in touch: optus.com.au/contactus. We monitor public social media mentions of Optus to support customers. Any information you share is handled under our Privacy Policy: optus.com.au/privacy.

Telmex

telmex.com

TELMEX, la empresa líder de telecomunicaciones y servicios TI en México, ha realizado importantes inversiones para desarrollar la plataforma tecnológica más robusta y vanguardista del país, que le permite ofrecer la más amplia gama de soluciones, con los mayores estándares de calidad, seguridad, confiabilidad y competitividad; por ello, es el mejor socio estratégico en servicios avanzados de telecomunicaciones y TI. Las Soluciones TI de TELMEX van desde la Conectividad hasta Servicios de Nube, Centros de Datos, Ciberseguridad, Colaboración y Soluciones de Negocio. Un portafolio enfocado a cubrir las necesidades y proporcionar atención en infraestructura y procesos, lo que permite a los clientes aprovechar al máximo su inversión en tecnología, mientras evolucionan hacia nuevos sistemas y plataformas como servicio. TELMEX permite desarrollar e implementar proyectos en empresas de cualquier tamaño y en cualquier vertical de industria, ofreciendo soluciones integrales, innovadoras y de clase mundial, a través de tecnología de punta; brindando conectividad soportada por la mayor cobertura nacional e internacional y anchos de banda que garantizan la continuidad de las operaciones de sus clientes.

Tata Communications

cb tatacommunications.com

Tata Communications is a digital ecosystem enabler that powers today’s fast-growing digital economy. We enable the digital transformation of enterprises globally, including 300 of the Fortune 500. We carry around 30% of the world’s internet routes and connects businesses to 60% of the world’s cloud giants. We have been a part of the rich heritage of the internet in India. Over the last 25 years, enterprise-enabled services have been essential to the adoption of digital services in the country. Connectivity is an essential fabric of sustenance for the economy. We are committed to enabling Industry leaders in this New World of Communications™, with our unique promise of delivering secure connected digital experiences. In 2020, we announced the launch of ‘Secure Connected Digital Experience’ (SCDx), a proposition intended to meet this growing, worldwide demand for new ways of operating, which includes far higher levels of working from home, rising security risks, a shift to digital commerce, and more contactless experiences. It will help companies currently relying on short-term fixes by providing holistic, secure, enterprise-level digital solutions that address current challenges and are fit for the long term. To know more, visit TataCommunications.com Tata Communications Limited is listed on the Bombay Stock Exchange and the National Stock Exchange of India and is present in over 200 countries and territories around the world. We are committed to being an equal opportunity workplace and to providing an inclusive environment to all employees. All qualified applicants will receive consideration for employment without regard to race, colour, religion, gender, gender identity or expression, sexual orientation, national origin, or any other status protected by law. Tata Communications and its Recruitment Partners do not charge any fee or security deposit from the candidate for offering employment.

SFR

sfr.com

SFR is the number one alternative telecoms operator in France. SFR is also an operator providing a comprehensive range of services meeting the expectations of private and business customers alike, offering them the best of the digital world. At year-end 2011, the total number of mobile customers was 21.5 million, and the active broadband residential customer base represented 5 million customers, which represent respectively a 31.3% and 22% market share.

vivo

vivo.com

vivo is a technology company that creates great products based on a design-driven value, with smart devices and intelligent services as its core. The company aims to build a bridge between humans and the digital world. Through unique creativity, vivo provides users with an increasingly convenient mobile and digital life. vivo has over 18,000 employees across the globe. While bringing together and developing the best local talents to deliver excellence, vivo is supported by a network of 10 R&D centers in Shenzhen, Dongguan, Nanjing, Beijing, Hangzhou, Shanghai, Xi'an, Taipei, Tokyo and San Diego, focusing on the development of state-of-the-art consumer technologies, including 5G, artificial intelligence, industrial design, imaging system and other up-and-coming technologies. vivo has also set up 7 production bases (including brand-authorized manufacturing centers), across China, South- and Southeast Asia, and more regions, with an annual production capacity of nearly 200 million smartphones. As of now, vivo has branched out its sales network across more than 60 countries and regions, and is winning more than 400 million users worldwide with its superior products and services. Following the company's core values, which include Benfen, design-driven value, user-orientation, continuous learning and team spirit. vivo has implemented a sustainable development strategy, with the vision of developing into a healthier, more sustainable world-class corporation. Official Site: www.vivo.com/en Facebook: @vivoGlobal Instagram: @vivo_global

Spectrum

spectrum.com

Spectrum is a suite of advanced communications services offered by Charter Communications, Inc. (NASDAQ:CHTR), a leading broadband connectivity company available to more than 57 million homes and small to large businesses across 41 states. Founded in 1993, Charter has evolved from providing cable TV to streaming, and from high-speed Internet to a converged broadband, WiFi and mobile experience. Over the Spectrum Fiber Broadband Network and supported by our 100% U.S.-based employees, the Company offers Seamless Connectivity and Entertainment with Spectrum Internet®, Mobile, TV and Voice products. More information can be found at corporate.charter.com.

Loading…

NEWS

Arrow Systems Integration CyberSecurity News

Latest updates, reports, and threat intel affecting the global network.

December 12, 2025 05:08 AM

AEROSPACE REDEFINED | Collins Aerospace

A printed circuit board factory in Puerto Rico demonstrates digital technologies for the rest of RTX.

Read Article

August 31, 2025 07:00 AM

Asia is ahead of the curve of using AI to fight fraud. Here's what the rest of the world can learn from it

As Asia's crime syndicates make headlines, Asian banks are quietly leading a shift in how to prevent fraud.

Read Article

March 28, 2025 07:38 PM

Technology Advisory, Solutions & Managed Services

Accelerate modernization and maximize results through AI, data, cloud and app development, cybersecurity, technology consulting, platforms, and more.

Read Article

September 10, 2024 12:01 AM

KPMG recognized as a worldwide Leader in Systems Integrators for Cybersecurity Consulting Services

KPMG firms have been named a worldwide Leader in the IDC MarketScape: Worldwide Systems Integrators/Consultancies for Cybersecurity Consulting Services.

Read Article

June 24, 2024 08:50 PM

Integrated cybersecurity for metaverse systems operating with artificial intelligence, blockchains, and cloud computing

In the ever-evolving realm of cybersecurity, the increasing integration of Metaverse systems with cutting-edge technologies such as Artificial Intelligence...

Read Article

May 24, 2024 07:00 AM

How cybersecurity shapes supply chain resilience

Explore how the relationship between cybersecurity and supply chain risk management shapes ecosystem-wide resilience. A report developed in...

Read Article

November 01, 2023 07:00 AM

Governor Hochul Announces Updates To New York's Nation-Leading Cybersecurity Regulations As Part Of Sweeping Effort To Protect Businesses And Consumers From Cyber Threats

Governor Kathy Hochul today announced that the New York State Department of Financial Services has amended its nation-leading cybersecurity...

Read Article

August 07, 2022 10:54 AM

GLOBAL SYSTEMS INTEGRATORS

Access the industry's best technology, people and intelligence to defend against cyberthreats, meet compliance demands, secure your cloud journey and more.

Read Article

June 03, 2022 07:00 AM

AI and automation for cybersecurity

Security leaders are using AI for cybersecurity to boost visibility and productivity across security operations.

Read Article

Loading…

CVE

Latest

Global CVEs (Not Company-Specific)

CVE-2026-18556

SUMMARY

Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass. This issue affects N-central: through 2026.1.

Published

Date2026-08-01

Updated

Date2026-08-01

RISK INFORMATION (Score: )

cvss4

Base Score: 8.2

Complexity: HIGH

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

https://uptime.n-able.com/

CVE-2026-55735

SUMMARY

Improper Verification of Cryptographic Signature in ueberauth guardian allows an unauthenticated attacker to revoke a victim's session with a forged token. Guardian.revoke/3 in lib/guardian.ex decodes the supplied token with peek/1, which performs no signature verification (it only base64-decodes the JWT header and payload). The resulting unverified claims are forwarded directly to the configured token module's revoke callback and the implementation's on_revoke callback, a state-mutating sink. The sibling operations refresh/2 and exchange/4 both call decode_and_verify first, so the signature is checked before anything acts on the claims; revoke/3 is the only state-mutating path that acts on claims without verifying the signature. An attacker who knows or guesses a victim's identifying claim values (jti, sub) can forge a JWT carrying those claims, sign it with an arbitrary key, and submit it to any endpoint that funnels a caller-supplied token into Guardian.revoke/3 (the standard logout / session-revocation pattern). When the token module mutates state keyed by the claims (whitelist deletion or blacklist insertion, for example a GuardianDb-style store), the victim's legitimate session is evicted. This is an unauthenticated session-revocation denial of service; the attacker never needs the signing secret. This issue affects guardian: from 1.0.0 before 2.4.1.

Published

Date2026-08-01

Updated

Date2026-08-01

RISK INFORMATION (Score: )

cvss4

Base Score: 8.2

Complexity: LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

CVE-2026-55734

SUMMARY

Allocation of Resources Without Limits or Throttling vulnerability in ueberauth guardian (Guardian.Permissions module) allows a denial of service via BEAM atom-table exhaustion. This vulnerability is associated with program file lib/guardian/permissions.ex and program routines 'Elixir.Guardian.Permissions':encode_permissions!/1, 'Elixir.Guardian.Permissions':encode_permissions_into_claims!/2, 'Elixir.Guardian.Permissions':do_encode_permissions!/2. The Guardian.Permissions mixin installs a public encode_permissions!/1 function on every module that does use Guardian.Permissions. For each key of the supplied map, encode_permissions!/1 calls String.to_atom(to_string(k)) before any validation runs. The integer-value clause of do_encode_permissions!/2 then short-circuits straight to encoding without validating the key against the configured permission set, so a key with an integer value is interned as a fresh atom with no exception raised. Atoms are never garbage collected and the BEAM atom table is a fixed-size resource (default roughly 1,048,576 entries), so each unique attacker-chosen key permanently consumes one slot. An attacker who can influence a permission map that reaches encode_permissions!/1 (for example a permissions map read from a request body and passed into token issuance via encode_permissions_into_claims!/2) can mint an unbounded number of atoms and exhaust the atom table, crashing the entire BEAM node and every service running on it. The sibling decode_permissions/1 is not affected because it skips keys absent from the configured permission set. This issue affects guardian: from 2.0.0 before 2.4.1.

Published

Date2026-08-01

Updated

Date2026-08-01

RISK INFORMATION (Score: )

cvss4

Base Score: 6.9

Complexity: LOW

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

CVE-2026-55733

SUMMARY

Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom creation from attacker-controlled binary input. Guardian.Permissions.AtomEncoding encodes permission scopes by passing arbitrary binaries to String.to_atom/1. When encode/3 in lib/guardian/permissions/atom_encoding.ex is called with a list, each binary entry is handled by the encode_value/3 binary clause, which calls String.to_atom(value) with no allow-list check. The perm_set argument (the application's small, finite set of legitimate permission names) is discarded, so any external string flows straight into atom creation. This encoder is selected with use Guardian.Permissions, encoding: Guardian.Permissions.AtomEncoding and reached through the imported encode/3 entry point. String.to_atom/1 creates a brand-new atom for every previously unseen binary, atoms are never garbage collected, and the BEAM atom table is fixed at roughly 1,048,576 entries by default. An application that funnels attacker-influenced permission scopes (from a request body, a JWT claim, or other external input) into encode/3 therefore mints one permanent atom per distinct value. A modest stream of varied, unauthenticated input permanently consumes the atom table and crashes the BEAM node with system_limit, taking down every application running on it. The default encoder is Guardian.Permissions.BitwiseEncoding, which is not affected. This issue affects guardian: from 2.0.0 before 2.4.1.

Published

Date2026-08-01

Updated

Date2026-08-01

RISK INFORMATION (Score: )

cvss4

Base Score: 6.9

Complexity: LOW

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

CVE-2026-54894

SUMMARY

Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom creation from attacker-influenced binary input. Guardian.Plug.Keys derives connection and session namespace keys by passing arbitrary binaries to String.to_atom/1. base_key/1 in lib/guardian/plug/keys.ex converts any binary into the atom :"guardian_<input>", and the derived helpers claims_key/1, resource_key/1, and token_key/1 create a second atom on top of that. key_from_other/1 likewise converts a regex-captured binary through String.to_atom/1. The public specs advertise String.t() as a valid argument, so passing a string is documented usage, and higher-level entry points such as Guardian.Plug.current_token(conn, key: key) thread the caller-supplied key straight into these functions. String.to_atom/1 creates a brand-new atom for every previously unseen binary, atoms are never garbage collected, and the BEAM atom table is fixed at roughly 1,048,576 entries by default. An application that routes attacker-influenced data (a tenant identifier, header, or other request input) into a Guardian key therefore mints one permanent atom per distinct value. A modest stream of varied, unauthenticated input permanently consumes the atom table and crashes the BEAM node, taking down every application running on it. This issue affects guardian: from 0.1.0 before 2.4.1.

Published

Date2026-08-01

Updated

Date2026-08-01

RISK INFORMATION (Score: )

cvss4

Base Score: 6.9

Complexity: LOW

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

Loading…

API

Access Data Using Our API

Get company history

curl -i -X GET 'https://api.rankiteo.com/underwriter-getcompany-history?
linkedin_id=axa' -H 'apikey: YOUR_API_KEY_HERE'

Try It API Documentation Rapid

MEASURE

What Do We Measure ?

Incident

Finding

Grade

Digital Assets

Every week, Rankiteo analyzes billions of signals to give organizations a sharper, faster view of emerging risks. With deeper, more actionable intelligence at their fingertips, security teams can outpace threat actors, respond instantly to Zero-Day attacks, and dramatically shrink their risk exposure window.

These are some of the factors we use to calculate the overall score:

Network SecurityIdentify exposed access points, detect misconfigured SSL certificates, and uncover vulnerabilities across the network infrastructure.

SBOM (Software Bill of Materials)Gain visibility into the software components used within an organization to detect vulnerabilities, manage risk, and ensure supply chain security.

CMDB (Configuration Management Database)Monitor and manage all IT assets and their configurations to ensure accurate, real-time visibility across the company's technology environment.

Threat IntelligenceLeverage real-time insights on active threats, malware campaigns, and emerging vulnerabilities to proactively defend against evolving cyberattacks.

Rankiteo

By Rankiteo

★ ★ ★ ★ ★

View on G2.com

Rankiteo is a unified scoring and risk platform that analyzes billions of signals weekly to help organizations gain faster, more actionable insights into emerging threats. Empowering teams to outpace adversaries and reduce exposure.

View latest plans →View all security reports →

MILESTONEG

Users
Love Us

Loading…