What is the official website of GEODIS | Freight Forwarding ?

The official website of GEODIS | Freight Forwarding is http://www.geodis.com.

What is GEODIS | Freight Forwarding's cybersecurity risk score?

GEODIS | Freight Forwarding has an AI-generated cybersecurity risk score of 747 out of 1000, indicating a Moderate security posture according to Rankiteo's assessment.

How many security incidents has GEODIS | Freight Forwarding experienced?

According to Rankiteo, GEODIS | Freight Forwarding currently holds 0 security badges, indicating that no recognized compliance certifications are currently verified for the organization.

Has GEODIS | Freight Forwarding been affected by any supply chain cyber incidents ?

According to Rankiteo, GEODIS | Freight Forwarding has not been affected by any supply chain cyber incidents, and no incident IDs are currently listed for the organization.

Does GEODIS | Freight Forwarding have SOC 2 Type 1 certification ?

According to Rankiteo, GEODIS | Freight Forwarding is not certified under SOC 2 Type 1.

Does GEODIS | Freight Forwarding have SOC 2 Type 2 certification ?

According to Rankiteo, GEODIS | Freight Forwarding does not hold a SOC 2 Type 2 certification.

Does GEODIS | Freight Forwarding comply with GDPR ?

According to Rankiteo, GEODIS | Freight Forwarding is not listed as GDPR compliant.

Does GEODIS | Freight Forwarding have PCI DSS certification ?

According to Rankiteo, GEODIS | Freight Forwarding does not currently maintain PCI DSS compliance.

Does GEODIS | Freight Forwarding comply with HIPAA ?

According to Rankiteo, GEODIS | Freight Forwarding is not compliant with HIPAA regulations.

Does GEODIS | Freight Forwarding have ISO 27001 certification ?

According to Rankiteo,GEODIS | Freight Forwarding is not certified under ISO 27001, indicating the absence of a formally recognized information security management framework.

Which industry does GEODIS | Freight Forwarding operate in ?

GEODIS | Freight Forwarding operates primarily in the Transportation, Logistics, Supply Chain and Storage industry.

How many employees does GEODIS | Freight Forwarding have ?

GEODIS | Freight Forwarding employs approximately 1 people worldwide.

Does GEODIS | Freight Forwarding own any subsidiaries ?

GEODIS | Freight Forwarding presently has no subsidiaries across any sectors.

How many LinkedIn followers does GEODIS | Freight Forwarding have ?

GEODIS | Freight Forwarding's official LinkedIn profile has approximately 76,844 followers.

What is the NAICS classification code for GEODIS | Freight Forwarding ?

GEODIS | Freight Forwarding is classified under the NAICS code 47, which corresponds to Transportation and Warehousing.

Does GEODIS | Freight Forwarding have a Crunchbase profile ?

No, GEODIS | Freight Forwarding does not have a profile on Crunchbase.

Does GEODIS | Freight Forwarding have a LinkedIn profile ?

Yes, GEODIS | Freight Forwarding maintains an official LinkedIn profile, which is actively utilized for branding and talent engagement, which can be accessed here: https://www.linkedin.com/company/geodisff.

How many cybersecurity incidents has GEODIS | Freight Forwarding experienced ?

As of August 2, 2026, Rankiteo reports that GEODIS | Freight Forwarding has not experienced any cybersecurity incidents.

How many peer or competitor companies does GEODIS | Freight Forwarding have ?

GEODIS | Freight Forwarding has an estimated 6,695 peer or competitor companies worldwide.

NEWRankiteo Cyber Underwriting Desktop - Score, price, and bind from your desktop

WindowsmacOSLinux

Download

Badge your company to reduce your risk score and your cyber insurance costs!

Link verified badges to your company page to build trust with insurers and customers.

Apply now and get your badge!

Internal validation & live display

Insurers and partners see a safer profile

Faster underwriting decisions

Trusted by insurers. Chosen by leaders.

Proud contributor to the Society of Actuaries.

GFF

Boost Score +25 with badge (5 left)

747

/1000

Moderate

772

/1000

Fair

GEODIS | Freight Forwarding Vendor Cyber Rating & Cyber Score

geodis.com

Add Your Compliance Badge

GEODIS is a leading global logistics provider acknowledged for its expertise across all aspects of the supply chain. As a growth partner to its clients, GEODIS specializes in four lines of business: Global Freight Forwarding, Global Contract Logistics, Distribution & Express Transport, and European Road Network. With a global network spanning nearly 170 countries and 53,000 employees, GEODIS is ranked no. 5 in its sector across the world. In 2023, GEODIS generated €11.6 billion in revenue. GEODIS is a company owned by SNCF group.

GFF A.I CyberSecurity Scoring

Scoring History

GFF

GEODIS | Freight Forwarding CyberSecurity News & History

Past Incidents

Attack Types

Entity

Type

Severity

Impact

Seen

Blog Details

Supply Chain Source

Incident Details

View

No data available

Loading…

A.I.

GFF Company Scoring based on AI Models

Cyber Incidents Likelihood 3 - 6 - 9 months

Actual

Prediction

Incident Predictions locked

Access Monitoring Plan

A.I Risk Score Likelihood 3 - 6 - 9 months

Actual

Prediction A

Prediction B

Prediction C

Prediction D

A.I. Risk Score Predictions locked

Access Monitoring Plan

Loading…

Underwriter Stats for GFF

Incidents vs Transportation, Logistics, Supply Chain and Storage Industry Avg (This Year)

No incidents recorded for GEODIS | Freight Forwarding in 2026.

Incidents vs All-Companies Average (This Year)

No incidents recorded for GEODIS | Freight Forwarding in 2026.

Incident Types GFF vs Transportation, Logistics, Supply Chain and Storage Industry Avg (This Year)

No incidents recorded for GEODIS | Freight Forwarding in 2026.

Incident History - GFF (X = Date, Y = Severity)

Loading…

SUBSIDIARY

GEODIS | Freight Forwarding Subsidiaries

GFF

Transportation, Logistics, Supply Chain and Storage

Website: http://www.geodis.com

Company Size: 1

GEODISTransportation, Logistics, Supply Chain and Storage

GEODIS | Distribution & ExpressTransports de fret et de colis

GEODIS | Contract LogisticsTransportation, Logistics, Supply Chain and Storage

GEODIS | Road TransportTransports routiers de fret

GEODIS | Supply Chain OptimizationTransportation, Logistics, Supply Chain and Storage

Loading…

GEODIS | Freight Forwarding Similar Companies

Delhivery

delhivery.com

Delhivery is India’s largest fully-integrated logistics services provider. With a nationwide network spanning over 18,850 pin codes, the company offers a comprehensive range of logistics solutions — including express parcel transportation, partial-truckload (PTL) and full-truckload (FTL) freight, cross-border services, supply chain solutions, Delhivery Direct (national and local courier services) and technology-enabled logistics. Comprehensive Solutions for Every Need ➡️Express Parcel: Send shipments across India, including heavy goods, with value-added services like real-time tracking, NDR Management, WhatsApp based updates, RTO, Protect ➡️Delivery Direct: All-in-one courier service that lets you send anything within the city or anywhere in India ➡️Rapid: A sub-2-hour delivery service helping brands offer faster deliveries and a better customer experience ➡️Supply Chain Solutions: Store and manage inventory at optimized locations across India, fulfilling orders for both B2B and B2C channels with precision. ➡️Partial Truckload (PTL):Leverage India’s large PTL network for door-to-door or hub-to-hub delivery with multimodal freight and smart dashboards. ➡️Full Truckload (FTL): Handle high-volume shipments with speed and efficiency through our professional network of truckload partners and our own fleet. ➡️Cross-Border Services: Ship parcels and freight to 220+ countries with door-to-door and port-to-port logistics ➡️TransportOne: Delhivery’s AI‑powered TMS that gives enterprises end‑to‑end optimization, from intelligent sourcing and load stacking to agentic ePOD and automated billing Our Impact at Scale ✔️4 Billion+ parcels shipped since inception ✔️Coverage of 99.5% of India’s population ✔️Trusted by 48,000+ businesses ✔️Shipped over 4.7 Million tonnes of freight ✔️Managing 22.05 Million+ sqft of logistics infrastructure Start shipping: https://one.delhivery.com/register Download Delhivery Direct App: https://appdelhivery.go.link/5YuVn

Rhenus Logistics

rhenus.group

The Rhenus Group is one of the leading logistics specialists with global business operations and annual turnover amounting to EUR 8.2 billion. 41,000 employees work at 1,330 business sites in more than 70+ countries and develop innovative solutions along the complete supply chain. Whether providing transport, warehousing, customs clearance or value-added services, the family-owned business pools its operations in various business units where the needs of customers are the major focus at all times. For further Information visit www.rhenus.group Imprint: https://www.rhenus.group/imprint/ Data Protection Policy: https://www.rhenus.group/data-protection-policy/

Aramex

aramex.com

Founded in 1982, Aramex has emerged as a global leader in logistics and transportation, renowned for its innovative services tailored to businesses and consumers. As a listed company on the Dubai Financial Market (since 2005) and headquartered in the UAE, our strategic location facilitates extensive customer reach worldwide, bridging the gap between East and West. With operations in 600+ cities across 70 countries, Aramex employs over 16,000 professionals. Our success is attributed to four distinct business products that provide scalable, diversified, and end-to- end services for customers. These products are: • International Express, encompassing Aramex's Parcel Forwarding Business (Shop & Ship and MyUS). • Domestic Express • Freight Forwarding • Logistics & Supply Chain Solutions Sustainability is at the core of our vision and mission. To build a truly sustainable business, we leverage our core competencies to make a positive impact as responsible members of the communities we serve. Through partnerships with local and international organizations, we strive to expand our reach and benefit more individuals through targeted programs and initiatives, ensuring long-term positive change and community development. For more information, please visit us: www.aramex.com

Yusen Logistics

yusen-logistics.com

Yusen Logistics is the insight-driven, customer-centric logistics partner to global business. We deliver this through an extended range of services from International Freight Forwarding and Contract Logistics to Supply Chain Solutions and Industry insights covering the full supply chain. We invest in a deep understanding of our customers' business, their customers, the challenges they face and the goals they want to achieve. Yusen Logistics has a global network linking Japan, the Americas, Europe, East Asia and South Asia & Oceania, and operates more than 650 distribution centers/offices in 46 countries and over 25.000 employees. Designing and implementing award winning solutions to complex supply chain requirements, Yusen Logistics’ skilled teams, state-of-the-art equipment and sophisticated technology deliver cost effective results with added value. Yusen Logistics delivers high performance solutions from raw materials to finished products throughout the supply chain. Working with manufacturers and retailers Yusen Logistics offers specialist expertise in: • Automotive • Aerospace • Consumer Electronics & Technology • Healthcare & Pharmaceuticals • Retail • Food Logistics Yusen Logistics works closely with customers to create enhanced solutions with the design, planning, and execution of key services including: • Global Freight Forwarding • Transportation Management • Warehousing and Distribution • End to end Supply Chains With regional headquarters in Europe, Japan, East Asia, Oceania and the Americas, Yusen Logistics’ international network covers almost every country in the world. Building on its established infrastructure Yusen Logistics is rolling out networks in emerging markets to mirror clients’ changing sourcing patterns. INSIGHT INTO ACTION. YUSEN LOGISTICS

DHL

dhl.com

DHL is the leading global brand in the logistics industry. Our divisions offer an unrivaled portfolio of logistics services ranging from national and international parcel delivery, e-commerce shipping and fulfillment solutions, international express, road, air and ocean transport to industrial supply chain management. With specialized solutions for growth markets and industries including technology, life sciences and healthcare, engineering, manufacturing & energy, auto-mobility and retail, DHL is decisively positioned as "The logistics company for the world". DHL is part of DHL Group. Privacy notice https://group.dhl.com/en/data-protection.html

C.H. Robinson

chrobinson.com

C.H. Robinson is the global leader in Lean AI supply chains. For more than a century, companies everywhere have looked to us to reimagine how goods move. Now, as we redefine what’s next for the industry, that same drive fuels our commitment to Building Tomorrow’s Supply Chains, Today™. Trusted by 83,000 customers and 450,000 contract carriers, we manage an unmatched 37 million shipments annually, representing $23 billion in freight. We deliver tailored solutions across the world via truckload, less-than-truckload, ocean, air, and more. With our unique combination of human insight and Lean AI working as one, supply chains move faster, smarter, and more sustainably. As a responsible global citizen, we proudly contribute millions to the causes that matter most to our employees. For more information visit www.chrobinson.com. (Nasdaq: CHRW)

La Poste Groupe

lapostegroupe.com

Premier réseau commercial de proximité en France, le groupe La Poste est organisé en 4 branches d’activité : Services-Courrier-Colis, Banque et Assurance, Distributeur physique et numérique, GeoPost/DPDGroup pour l'international. Présent dans plus de 63 pays, sur 5 continents, il a réalisé un chiffre d’affaires de 34,1 Mds€ en 2023. En 2021, le groupe La Poste est devenu la première entreprise publique à adopter la qualité de société à mission. 4 engagements sociétaux sont désormais inscrits dans ses statuts : • Contribuer au développement et à la cohésion des territoires • Favoriser l’inclusion sociale • Promouvoir un numérique éthique, inclusif et frugal • Œuvrer à l’accélération de la transition écologique pour tous Le groupe La Poste, avec plus de 232 000 collaborateurs, naturellement et historiquement engagé pour la société, se mobilise pour rendre ses activités plus durables au regard des enjeux sociétaux et environnementaux, et pour faciliter la transition écologique de tous les Français.

Penske Logistics

penskelogistics.com

Penske Logistics is a Penske Transportation Solutions company headquartered in Reading, Pennsylvania. The company is a leading provider of innovative supply chain and logistics solutions. Penske offers solutions including dedicated transportation, distribution center management, 4PL and lead logistics, transportation management, freight brokerage, and a comprehensive array of technologies to keep the world moving forward. We serve a variety of industries including: automotive; food, beverage, grocery, wine and spirits; cold chain; convenience and drug stores; quick service restaurants (QSRs); retail; big box retailers; building and construction products; CPG; healthcare; energy; industrial manufacturing; consumer appliances and consumer electronics; and many others. Visit PenskeLogistics.com to learn more.

Poste Italiane

posteitaliane.it

L'azienda opera in Italia e svolge un ruolo importante nel Paese, dando un forte contributo alla filiera produttiva e all'economia nazionale. Il Gruppo Poste Italiane rappresenta una realtà unica per dimensioni, riconoscibilità, capillarità e fiducia da parte della clientela, e fornisce un importante contributo al tessuto economico, sociale e produttivo del Paese. Quotata alla Borsa di Milano dal 2015, Poste Italiane ha un flottante di circa il 35%; il 65% circa delle azioni è poi ripartito tra il Ministero dell’Economia e delle Finanze, che ne detiene una quota del 29,26%, e da Cassa depositi e prestiti che possiede una quota del 35%. Da maggio 2023 Silvia Maria Rovere è Presidente. Da Aprile 2017 Matteo Del Fante Amministratore Delegato. Da febbraio 2024 Giuseppe Lasco è Direttore Generale. Poste Italiane è oggi la più grande realtà del comparto logistico in Italia ed è leader nel settore finanziario, assicurativo e dei servizi di pagamento. Il Gruppo opera esclusivamente in Italia ed è parte integrante del sistema economico, sociale e produttivo del Paese, in quanto realtà unica per dimensioni, riconoscibilità e capillarità. Le attività dell’Azienda generano quindi impatti significativi su tutto il territorio, anche in ottica di raggiungimento degli Obiettivi di Sviluppo Sostenibile (SDGs).” Il Purpose di Poste Italiane: Crescere responsabilmente grazie al decisivo contributo delle proprie persone per il successo sostenibile, l’innovazione, digitalizzazione e la coesione sociale del Paese. Info su: https://www.posteitaliane.it (Ultimo aggiornamento marzo 2024) Poste Italiane aderisce all’Arbitro Assicurativo (AAS), operativo dal 15 gennaio 2026. Maggiori informazioni su https://www.poste.it/assistenza/arbitro-assicurativo

Loading…

NEWS

GEODIS | Freight Forwarding CyberSecurity News

Latest updates, reports, and threat intel affecting the global network.

October 30, 2025 07:00 AM

Freight thieves adopt cyber tools

Learn how high-tech thieves are targeting the freight industry with cyber-enabled tactics, and how to protect your cargo from sophisticated...

Read Article

October 23, 2025 07:00 AM

Top Cyber Threats in the Freight Rail Sector

The importance of freight rail to the U.S. economy and its position as a backbone of the nation's infrastructure cannot be overstated.

Read Article

July 03, 2025 07:00 AM

NMFTA Tackles Cyber-Enabled Cargo Thefts With New Framework

The National Motor Freight Traffic Association has released a framework aimed at helping carriers and brokers fight back against the growing and increasingly...

Read Article

June 25, 2025 07:00 AM

Estes Forwarding Worldwide hit by cyberattack

A cyberattack occurred against Estes Forwarding Worldwide (EFW) on May 28, the company told FreightWaves on Wednesday.

Read Article

June 04, 2025 07:00 AM

Why cyber resilience should be a top priority for freight forwarders

Cybersecurity has become a top priority for the industry, ensuring that digital transformation efforts remain sustainable and secure.

Read Article

May 12, 2025 07:00 AM

Highway Releases Freight Fraud Index Revealing 400,000 Sophisticated Fraud Attempts in Q1 2025

The index reveals which fraud and strategic cargo theft tactics continue to rise, like identity theft, false pick-ups, sold Motor Carriers (MCs), double-...

Read Article

May 08, 2025 07:00 AM

Cyberthreats surge against US logistics infrastructure

Cybersecurity provider Trellix recently released its April “CyberThreat Report” revealing an alarming rise in cyberattacks targeting...

Read Article

May 01, 2025 07:00 AM

Aurora Begins Commercial Driverless Trucking in Texas, Ushering in a New Era of Freight

Aurora Innovation, Inc. (NASDAQ: AUR) has successfully launched its commercial self-driving trucking service in Texas.

Read Article

March 31, 2025 07:00 AM

Cyber threats to rail, ports, airports could cripple US military mobilization, FDD report warns

A new report from the Cyberspace Solarium Commission reveals that U.S. adversaries are aware that targeting critical infrastructure through...

Read Article

Loading…

CVE

Latest

Global CVEs (Not Company-Specific)

CVE-2026-18556

SUMMARY

Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass. This issue affects N-central: through 2026.1.

Published

Date2026-08-01

Updated

Date2026-08-01

RISK INFORMATION (Score: )

cvss4

Base Score: 8.2

Complexity: HIGH

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

https://uptime.n-able.com/

CVE-2026-55735

SUMMARY

Improper Verification of Cryptographic Signature in ueberauth guardian allows an unauthenticated attacker to revoke a victim's session with a forged token. Guardian.revoke/3 in lib/guardian.ex decodes the supplied token with peek/1, which performs no signature verification (it only base64-decodes the JWT header and payload). The resulting unverified claims are forwarded directly to the configured token module's revoke callback and the implementation's on_revoke callback, a state-mutating sink. The sibling operations refresh/2 and exchange/4 both call decode_and_verify first, so the signature is checked before anything acts on the claims; revoke/3 is the only state-mutating path that acts on claims without verifying the signature. An attacker who knows or guesses a victim's identifying claim values (jti, sub) can forge a JWT carrying those claims, sign it with an arbitrary key, and submit it to any endpoint that funnels a caller-supplied token into Guardian.revoke/3 (the standard logout / session-revocation pattern). When the token module mutates state keyed by the claims (whitelist deletion or blacklist insertion, for example a GuardianDb-style store), the victim's legitimate session is evicted. This is an unauthenticated session-revocation denial of service; the attacker never needs the signing secret. This issue affects guardian: from 1.0.0 before 2.4.1.

Published

Date2026-08-01

Updated

Date2026-08-01

RISK INFORMATION (Score: )

cvss4

Base Score: 8.2

Complexity: LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

CVE-2026-55734

SUMMARY

Allocation of Resources Without Limits or Throttling vulnerability in ueberauth guardian (Guardian.Permissions module) allows a denial of service via BEAM atom-table exhaustion. This vulnerability is associated with program file lib/guardian/permissions.ex and program routines 'Elixir.Guardian.Permissions':encode_permissions!/1, 'Elixir.Guardian.Permissions':encode_permissions_into_claims!/2, 'Elixir.Guardian.Permissions':do_encode_permissions!/2. The Guardian.Permissions mixin installs a public encode_permissions!/1 function on every module that does use Guardian.Permissions. For each key of the supplied map, encode_permissions!/1 calls String.to_atom(to_string(k)) before any validation runs. The integer-value clause of do_encode_permissions!/2 then short-circuits straight to encoding without validating the key against the configured permission set, so a key with an integer value is interned as a fresh atom with no exception raised. Atoms are never garbage collected and the BEAM atom table is a fixed-size resource (default roughly 1,048,576 entries), so each unique attacker-chosen key permanently consumes one slot. An attacker who can influence a permission map that reaches encode_permissions!/1 (for example a permissions map read from a request body and passed into token issuance via encode_permissions_into_claims!/2) can mint an unbounded number of atoms and exhaust the atom table, crashing the entire BEAM node and every service running on it. The sibling decode_permissions/1 is not affected because it skips keys absent from the configured permission set. This issue affects guardian: from 2.0.0 before 2.4.1.

Published

Date2026-08-01

Updated

Date2026-08-01

RISK INFORMATION (Score: )

cvss4

Base Score: 6.9

Complexity: LOW

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

CVE-2026-55733

SUMMARY

Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom creation from attacker-controlled binary input. Guardian.Permissions.AtomEncoding encodes permission scopes by passing arbitrary binaries to String.to_atom/1. When encode/3 in lib/guardian/permissions/atom_encoding.ex is called with a list, each binary entry is handled by the encode_value/3 binary clause, which calls String.to_atom(value) with no allow-list check. The perm_set argument (the application's small, finite set of legitimate permission names) is discarded, so any external string flows straight into atom creation. This encoder is selected with use Guardian.Permissions, encoding: Guardian.Permissions.AtomEncoding and reached through the imported encode/3 entry point. String.to_atom/1 creates a brand-new atom for every previously unseen binary, atoms are never garbage collected, and the BEAM atom table is fixed at roughly 1,048,576 entries by default. An application that funnels attacker-influenced permission scopes (from a request body, a JWT claim, or other external input) into encode/3 therefore mints one permanent atom per distinct value. A modest stream of varied, unauthenticated input permanently consumes the atom table and crashes the BEAM node with system_limit, taking down every application running on it. The default encoder is Guardian.Permissions.BitwiseEncoding, which is not affected. This issue affects guardian: from 2.0.0 before 2.4.1.

Published

Date2026-08-01

Updated

Date2026-08-01

RISK INFORMATION (Score: )

cvss4

Base Score: 6.9

Complexity: LOW

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

CVE-2026-54894

SUMMARY

Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom creation from attacker-influenced binary input. Guardian.Plug.Keys derives connection and session namespace keys by passing arbitrary binaries to String.to_atom/1. base_key/1 in lib/guardian/plug/keys.ex converts any binary into the atom :"guardian_<input>", and the derived helpers claims_key/1, resource_key/1, and token_key/1 create a second atom on top of that. key_from_other/1 likewise converts a regex-captured binary through String.to_atom/1. The public specs advertise String.t() as a valid argument, so passing a string is documented usage, and higher-level entry points such as Guardian.Plug.current_token(conn, key: key) thread the caller-supplied key straight into these functions. String.to_atom/1 creates a brand-new atom for every previously unseen binary, atoms are never garbage collected, and the BEAM atom table is fixed at roughly 1,048,576 entries by default. An application that routes attacker-influenced data (a tenant identifier, header, or other request input) into a Guardian key therefore mints one permanent atom per distinct value. A modest stream of varied, unauthenticated input permanently consumes the atom table and crashes the BEAM node, taking down every application running on it. This issue affects guardian: from 0.1.0 before 2.4.1.

Published

Date2026-08-01

Updated

Date2026-08-01

RISK INFORMATION (Score: )

cvss4

Base Score: 6.9

Complexity: LOW

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

Loading…

API

Access Data Using Our API

Get company history

curl -i -X GET 'https://api.rankiteo.com/underwriter-getcompany-history?
linkedin_id=axa' -H 'apikey: YOUR_API_KEY_HERE'

Try It API Documentation Rapid

MEASURE

What Do We Measure ?

Incident

Finding

Grade

Digital Assets

Every week, Rankiteo analyzes billions of signals to give organizations a sharper, faster view of emerging risks. With deeper, more actionable intelligence at their fingertips, security teams can outpace threat actors, respond instantly to Zero-Day attacks, and dramatically shrink their risk exposure window.

These are some of the factors we use to calculate the overall score:

Network SecurityIdentify exposed access points, detect misconfigured SSL certificates, and uncover vulnerabilities across the network infrastructure.

SBOM (Software Bill of Materials)Gain visibility into the software components used within an organization to detect vulnerabilities, manage risk, and ensure supply chain security.

CMDB (Configuration Management Database)Monitor and manage all IT assets and their configurations to ensure accurate, real-time visibility across the company's technology environment.

Threat IntelligenceLeverage real-time insights on active threats, malware campaigns, and emerging vulnerabilities to proactively defend against evolving cyberattacks.

Rankiteo

By Rankiteo

★ ★ ★ ★ ★

View on G2.com

Rankiteo is a unified scoring and risk platform that analyzes billions of signals weekly to help organizations gain faster, more actionable insights into emerging threats. Empowering teams to outpace adversaries and reduce exposure.

View latest plans →View all security reports →

MILESTONEG

Users
Love Us

Loading…