What is the official website of Groupe Rocher ?

The official website of Groupe Rocher is http://www.groupe-rocher.com.

What is Groupe Rocher's cybersecurity risk score?

Groupe Rocher has an AI-generated cybersecurity risk score of 766 out of 1000, indicating a Fair security posture according to Rankiteo's assessment.

How many security incidents has Groupe Rocher experienced?

According to Rankiteo, Groupe Rocher currently holds 0 security badges, indicating that no recognized compliance certifications are currently verified for the organization.

Has Groupe Rocher been affected by any supply chain cyber incidents ?

According to Rankiteo, Groupe Rocher has not been affected by any supply chain cyber incidents, and no incident IDs are currently listed for the organization.

Does Groupe Rocher have SOC 2 Type 1 certification ?

According to Rankiteo, Groupe Rocher is not certified under SOC 2 Type 1.

Does Groupe Rocher have SOC 2 Type 2 certification ?

According to Rankiteo, Groupe Rocher does not hold a SOC 2 Type 2 certification.

Does Groupe Rocher comply with GDPR ?

According to Rankiteo, Groupe Rocher is not listed as GDPR compliant.

Does Groupe Rocher have PCI DSS certification ?

According to Rankiteo, Groupe Rocher does not currently maintain PCI DSS compliance.

Does Groupe Rocher comply with HIPAA ?

According to Rankiteo, Groupe Rocher is not compliant with HIPAA regulations.

Does Groupe Rocher have ISO 27001 certification ?

According to Rankiteo,Groupe Rocher is not certified under ISO 27001, indicating the absence of a formally recognized information security management framework.

Which industry does Groupe Rocher operate in ?

Groupe Rocher operates primarily in the Personal Care Product Manufacturing industry.

How many employees does Groupe Rocher have ?

Groupe Rocher employs approximately 2,657 people worldwide.

Does Groupe Rocher own any subsidiaries ?

Groupe Rocher presently has no subsidiaries across any sectors.

How many LinkedIn followers does Groupe Rocher have ?

Groupe Rocher's official LinkedIn profile has approximately 149,256 followers.

What is the NAICS classification code for Groupe Rocher ?

Groupe Rocher is classified under the NAICS code 32562, which corresponds to Toilet Preparation Manufacturing.

Does Groupe Rocher have a Crunchbase profile ?

No, Groupe Rocher does not have a profile on Crunchbase.

Does Groupe Rocher have a LinkedIn profile ?

Yes, Groupe Rocher maintains an official LinkedIn profile, which is actively utilized for branding and talent engagement, which can be accessed here: https://www.linkedin.com/company/groupe-rocher.

How many cybersecurity incidents has Groupe Rocher experienced ?

As of August 2, 2026, Rankiteo reports that Groupe Rocher has experienced 1 cybersecurity incidents.

How many peer or competitor companies does Groupe Rocher have ?

Groupe Rocher has an estimated 1,707 peer or competitor companies worldwide.

What types of cybersecurity incidents has Groupe Rocher faced ?

Incident Types: The types of cybersecurity incidents that have occurred include Breach.

NEWRankiteo Cyber Underwriting Desktop - Score, price, and bind from your desktop

WindowsmacOSLinux

Download

Badge your company to reduce your risk score and your cyber insurance costs!

Link verified badges to your company page to build trust with insurers and customers.

Apply now and get your badge!

Internal validation & live display

Insurers and partners see a safer profile

Faster underwriting decisions

Trusted by insurers. Chosen by leaders.

Proud contributor to the Society of Actuaries.

Groupe Rocher

Boost Score +25 with badge (5 left)

766

/1000

Fair

791

/1000

Fair

Groupe Rocher Vendor Cyber Rating & Cyber Score

groupe-rocher.com

Add Your Compliance Badge

Le Groupe Rocher, entreprise française d'origine bretonne, est composé de 4 marques de produits beauté et bien-être naturels, efficaces et engagés : Yves Rocher, Sabon, Arbonne et Docteur Pierre Ricaud. Avec plus de 13 000 employés, 50 millions de clientes et un chiffre d'affaires de plus de 2,4 milliards d'euros, il opère dans plus de 110 pays sous la direction de Bris Rocher, Président du Groupe, et de Jean-David Schwartz, Directeur Général Exécutif depuis 2023. Depuis sa création, notre groupe s’engage à reconnecter les femmes et les hommes à la nature car nous croyons à l’impact positif de la nature sur notre bien-être. Pour aller plus loin, nous sommes devenus Entreprise à Mission et poursuivons l’ambition de développer un

Groupe Rocher A.I CyberSecurity Scoring

Scoring History

Groupe Rocher

Groupe Rocher CyberSecurity News & History

Past Incidents

Attack Types

Entity

Type

Severity

Impact

Seen

Blog Details

Supply Chain Source

Incident Details

View

Groupe Rocher

Breach

04/2020

ARB1315301222

Loading…

A.I.

Groupe Rocher Company Scoring based on AI Models

Cyber Incidents Likelihood 3 - 6 - 9 months

Actual

Prediction

Incident Predictions locked

Access Monitoring Plan

A.I Risk Score Likelihood 3 - 6 - 9 months

Actual

Prediction A

Prediction B

Prediction C

Prediction D

A.I. Risk Score Predictions locked

Access Monitoring Plan

Loading…

Underwriter Stats for Groupe Rocher

Incidents vs Personal Care Product Manufacturing Industry Avg (This Year)

No incidents recorded for Groupe Rocher in 2026.

Incidents vs All-Companies Average (This Year)

No incidents recorded for Groupe Rocher in 2026.

Incident Types Groupe Rocher vs Personal Care Product Manufacturing Industry Avg (This Year)

No incidents recorded for Groupe Rocher in 2026.

Incident History - Groupe Rocher (X = Date, Y = Severity)

Loading…

SUBSIDIARY

Groupe Rocher Subsidiaries

Groupe Rocher

Personal Care Product Manufacturing

Website: http://www.groupe-rocher.com

Company Size: 10,001+ employees

Yves RocherRetail

ArbonneManufacturing

FLORMARPersonal Care Product Manufacturing

Petit BateauTextile Manufacturing

Petit Bateau FabricantFabrication de textiles

StanhomeManufacturing

Loading…

Groupe Rocher Similar Companies

Mary Kay Global

marykay.com

About Mary Kay - Then. Now. Always. One of the original glass ceiling breakers, Mary Kay Ash founded her dream beauty brand in Texas in 1963 with one goal: to enrich women’s lives. That dream has blossomed into a global company with unlimited opportunities to do something beautiful for people around the globe – and within our own company.  We employ nearly 4,000 people in corporate positions around the world. The role of Mary Kay employees is to serve the beauty needs of our customers and support the needs of our independent sales force members who work with Mary Kay Inc. as independent contractors selling the amazing Mary Kay products directly to their customers in more than 35 countries around the world. Mary Kay’s long-term success has been made possible by our uniquely people-oriented corporate culture and a continual drive for innovation. Corporate teams with expertise in R&D, marketing, communications, legal, logistics, manufacturing, IT, supply chain, quality, engineering, analytics and other areas make sure the independent sales force have the products, marketing strategies, technology and support structure to succeed as entrepreneurs. Mary Kay is dedicated to investing in the science behind beauty and manufacturing cutting-edge skincare, color cosmetics, nutritional supplements, and fragrances. Mary Kay believes in preserving our planet for future generations, protecting women impacted by cancer and domestic abuse, and encouraging youth to follow their dreams. Learn more at marykay.com/corporatecareers, find us on Facebook and Instagram.

The Estée Lauder Companies Inc.

elcompanies.com

The Estée Lauder Companies Inc. is one of the world’s leading manufacturers, marketers, and sellers of quality skin care, makeup, fragrance, and hair care products, and is a steward of outstanding luxury and prestige brands globally. The company’s products are sold in approximately 150 countries and territories under brand names including: Estée Lauder, Aramis, Clinique, Lab Series, Origins, M·A·C, La Mer, Bobbi Brown Cosmetics, Aveda, Jo Malone London, Bumble and bumble, Darphin Paris, TOM FORD, Smashbox, AERIN Beauty, Le Labo, Editions de Parfums Frédéric Malle, GLAMGLOW, KILIAN PARIS, Too Faced, Dr.Jart+, the DECIEM family of brands, including The Ordinary and NIOD, and BALMAIN Beauty. To explore our current job openings, go to www.elcompanies.com

Grupo Boticário

grupoboticario.com.br

Beleza é o negócio do Grupo Boticário. Para nós, ela se traduz em nossas quatro unidades de negócio com atuação no setor cosmético: O Boticário, Eudora, quem disse, berenice? e The Beauty Box. A beleza também está no empreendedorismo, na sustentabilidade, inovação, ética e integridade que inspiram nossa conduta e estimulam as atitudes das pessoas. A beleza de nossa organização se expressa , ainda, na Fundação Grupo Boticário de Proteção à Natureza, instituição sem fins lucrativos que realiza ações de conscientização e conservação da natureza em todo o país, desde 1990. Para nós, resultados econômicos são reflexos desta postura e de nosso ambiente de trabalho amistoso, diverso e criativo, que promove o desenvolvimento profissional contínuo dos mais de 5.700 colaboradores que fazem parte da organização. Esta soma incentiva nossa rede colaborativa a fazer sempre mais e nos insere nas listas das melhores empresas para trabalhar e começar a carreira no Brasil, de acordo com os rankings do Great Place to Work e das revistas Exame e Você S/A. Saiba mais sobre o Grupo Boticário: www.grupoboticario.com.br www.oboticario.com.br www.eudora.com.br www.quemdisseberenice.com.br www.thebeautybox.com.br www.fundacaogrupoboticario.org.br Acesse hotsite do Relatório de Sustentabilidade 2012 - grupoboticario.com.br/relatoriosustentabilidade - e conheça nossa estratégia de sustentabilidade focada em Matérias-Primas e Embalagens, Canais de Venda e Ecoeficiência.

O Boticário

oboticario.com.br

A beleza transforma, encanta, conquista e também pode ser conquistada. Eis o ideal de beleza que O Boticário multiplica com seus produtos, lojas e em sua relação com o público. Desde 1977, O Boticário soma inspiração, ousadia, inovação e qualidade, despertando o respeito do mercado, a confiança dos parceiros e a admiração dos consumidores. Conheça mais sobre O Boticário: Instagram: http://instagram.com/oboticario Facebook: http://www.facebook.com/oboticario Youtube: http://www.youtube.com/boticario Twitter: http://twitter.com/oboticario Loja Online: www.boticario.com.br

Beiersdorf

beiersdorf.com

Beiersdorf has been a pioneer in innovative, high-quality skin care products and groundbreaking skin research for over 140 years. Our internationally beloved brands, including NIVEA – the world’s no. 1 skin care brand –, Eucerin, Hansaplast, La Prairie and Chantecaille, are cherished by millions around the world. Our diverse and trusted portfolio of brands also includes Aquaphor, Coppertone, Labello, 8x4 and Hidrofugal. With a team of over 20,000 dedicated employees worldwide, Beiersdorf is united by shared core values, a vibrant corporate culture and our guiding purpose: Care Beyond Skin. We are committed to an ambitious sustainability agenda that creates real value for consumers, society and the environment. At Beiersdorf, our people are our greatest asset – they make all the difference in our success now and in the future. If you’re inspired to join us in our mission to be the world’s best skin care company, we invite you to explore the exciting career paths we offer. As the inventors of modern skin care, we provide countless opportunities for growth and meaningful responsibilities across the globe. Whether you're just starting your career or are a seasoned professional and whether your background is in science or business, our open, inclusive and purpose-driven corporate culture is designed to help you thrive. We offer the freedom to unleash your entrepreneurial spirit and share your passion for our brands, people and innovative technologies and the planet. Join us at Beiersdorf, where your ideas and enthusiasm can shape the future of skin care. Imprint: https://www.beiersdorf.com/meta-pages/imprint Social Media Netiquette: https://www.beiersdorf.com/meta-pages/social-media-policy

Coty

cb Coty.com

Since 1904, Coty has fearlessly pioneered innovation across the beauty industry. We have a reputation for breaking new ground; a history of ‘firsts’ and ‘bests’ that has laid the foundation for the industry as we know it today. For over a century, our brands have been empowering people to express themselves and create their own vision of beauty. It’s a legacy we’re proud to own and grow. We work hand-in-hand with our people, our partners and our customers. Together, we unleash every vision of beauty. We stand for the beauty of diversity and the diversity of beauty - celebrating and inspiring all the expressions of beauty that exist and that will exist. We honor you, and we honor our planet. We create Beauty That Lasts. A beauty that is both good to people and the world. Our mission is to create a forward thinking beauty; Products that provide new, innovative and simply better science based solutions. Let’s keep making over the beauty world TOGETHER.

L'Oréal

loreal.com

No.1 Beauty Group Worldwide. No.1 most innovative company in Europe (Fortune's ranking). We are 90K employees across 150 countries on five continents, united by our shared purpose: creating the beauty that moves the world. Our 37 international brands are divided into four unique Divisions: Luxe, Consumer Products, Dermatological Beauty, and Professional Products. This diverse portfolio includes brands like Kiehl’s, Lancôme, Giorgio Armani Beauty, Yves Saint Laurent Beauté, Ralph Lauren, Aesop, Maybelline New York, Essie, Kérastase, IT Cosmetics, Prada Beauty, Biotherm, Shu Uemura, Viktor&Rolf, Maison Margiela, Urban Decay, Redken, Vichy, La Roche-Posay, Diesel, Garnier, L’Oréal Paris, and more. For more than a century, L’Oréal has devoted itself solely to one business: beauty. We want to bring beauty to all people. Our goal is to win over another one billion consumers around the world by innovating and creating cosmetic and skincare products that meet the infinite diversity of their beauty needs and desires. That’s about us… now what about you? You are driven and up for a challenge! You’re passionate about putting your best foot forward, but you’re not afraid to fail either. You love to learn, grow and make an impact on the world. You can be an intern, or at a senior level position, we’re always looking for new people to join our teams. If you are ready to take charge of your career and join us, you’re one click away: https://careers.loreal.com/en_US/content Interested about our quest to the next billion consumers, follow us here to get the insider scoop on our business, culture, and tips on how to join us to shape the future of beauty. Freedom to go beyond, that’s the beauty of L’Oréal.

Natura

natura.com.br

Founded in 1969, Natura is a Brazilian multinational in the cosmetics and personal care segment, a leader in direct sales in Brazil, and recognized for protecting the Amazon social biodiversity through its sustainable business model. Cruelty free. 100% vegan. With 7,000 employees and 2 million beauty Consultants worldwide, Natura operates in 11 countries. In 2014, Natura became the first publicly traded company to receive B Corp ™ certification, and its third certification was concluded in 2020. Natura’s Ekos line is certified by the Union for Ethical Biotrade (UEBT). Learn more: natura.com

Avon

avonworldwide.com

Think you know Avon? Think again. We’ve been doing beauty differently for 135 years. Pioneering in listening to women’s needs and speaking out for them. Standing for what matters to them. Supporting their endeavours. We’re a company that connects people through beauty, sharing passion, innovation and expertise - affordably. We use the power of beauty to transform women’s lives for the better. We were founded to provide an opportunity for women to earn and learn – bringing economic freedom for our Beauty Advisers so they can shape their own future. We continue to carry this spirit with us today. Our independent Representatives provide millions of customers worldwide with trusted, personal beauty advice and products to help them express their individuality. We believe in beauty democracy: inclusive beauty that is open to all. We’re passionate about keeping you at the forefront of beauty, creating products that embrace the hottest trends and cutting-edge technology, alongside everyday essentials that will be the staples of your beauty kit. We believe in a better world for women, which is a better world for all. We believe everyone is equal and we champion gender equality. We speak up and speak out on issues that matter to our communities; supporting causes that help women’s health and wellbeing, including: • Breast cancer, the most commonly occurring cancer in women, • Violence against women and girls, which will impact 1 in 3 in their lifetime There’s still work to do. And we promise to continue doing more. Join us and be part of the movement..

Loading…

NEWS

Groupe Rocher CyberSecurity News

Latest updates, reports, and threat intel affecting the global network.

March 10, 2026 07:00 AM

Daniel Rocher

Daniel Rocher is the son of Yves Rocher, who founded the French cosmetics giant Groupe Rocher in 1959. Groupe Rocher owns beauty and...

Read Article

March 10, 2026 07:00 AM

Bris Rocher

Bris Rocher became the CEO of French cosmetics giant Groupe Rocher at the age of 31, after the death of his grandfather and the company's...

Read Article

February 15, 2026 08:00 AM

Week in review: Exploited newly patched BeyondTrust RCE, United Airlines CISO on building resilience

Here's an overview of some of last week's most interesting news, articles, interviews and videos: United Airlines CISO on building...

Read Article

February 11, 2026 08:00 AM

Groupe Rocher CISO on strengthening a modern retail cybersecurity strategy

To bridge this gap, at Groupe Rocher, we have chosen to integrate cybersecurity into the core business strategy, ensuring that security measures...

Read Article

June 30, 2025 07:00 AM

Yves Rocher-owned Sabon to shutter Israel operations, lay off 270 workers

Sabon, owned by French cosmetics giant Yves Rocher, is closing its manufacturing plant and global logistics headquarters in Kiryat Gat.

Read Article

April 22, 2025 07:00 AM

Yves Rocher Revives the Vinegar Rinse with Clean Haircare Appeal

Yves Rocher's Shine Vinegar Rinsing Lotion combines a French tradition with modern, clean beauty haircare innovation for a natural solution.

Read Article

January 15, 2025 08:00 AM

Groupe Rocher Plans to Divest Petit Bateau and Stanhome

PARIS — Groupe Rocher plans to start taking steps to divest its Petit Bateau children's clothing brand and Stanhome home care business as it...

Read Article

February 28, 2024 08:00 AM

Castro to expand to US to market Yves Rocher

Israeli fashion group Castro (TASE: CAST) is expanding to the US. The company has reported that it has received exclusive rights to the French cosmetics brand...

Read Article

February 04, 2021 08:00 AM

Calls Online to Boycott Yves Rocher Grow

Russian opposition leader Alexei Navalny has just been sentenced to two years detention for violating parole in a case linked to Yves...

Read Article

Loading…

CVE

Latest

Global CVEs (Not Company-Specific)

CVE-2026-18556

SUMMARY

Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass. This issue affects N-central: through 2026.1.

Published

Date2026-08-01

Updated

Date2026-08-01

RISK INFORMATION (Score: )

cvss4

Base Score: 8.2

Complexity: HIGH

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

https://uptime.n-able.com/

CVE-2026-55735

SUMMARY

Improper Verification of Cryptographic Signature in ueberauth guardian allows an unauthenticated attacker to revoke a victim's session with a forged token. Guardian.revoke/3 in lib/guardian.ex decodes the supplied token with peek/1, which performs no signature verification (it only base64-decodes the JWT header and payload). The resulting unverified claims are forwarded directly to the configured token module's revoke callback and the implementation's on_revoke callback, a state-mutating sink. The sibling operations refresh/2 and exchange/4 both call decode_and_verify first, so the signature is checked before anything acts on the claims; revoke/3 is the only state-mutating path that acts on claims without verifying the signature. An attacker who knows or guesses a victim's identifying claim values (jti, sub) can forge a JWT carrying those claims, sign it with an arbitrary key, and submit it to any endpoint that funnels a caller-supplied token into Guardian.revoke/3 (the standard logout / session-revocation pattern). When the token module mutates state keyed by the claims (whitelist deletion or blacklist insertion, for example a GuardianDb-style store), the victim's legitimate session is evicted. This is an unauthenticated session-revocation denial of service; the attacker never needs the signing secret. This issue affects guardian: from 1.0.0 before 2.4.1.

Published

Date2026-08-01

Updated

Date2026-08-01

RISK INFORMATION (Score: )

cvss4

Base Score: 8.2

Complexity: LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

CVE-2026-55734

SUMMARY

Allocation of Resources Without Limits or Throttling vulnerability in ueberauth guardian (Guardian.Permissions module) allows a denial of service via BEAM atom-table exhaustion. This vulnerability is associated with program file lib/guardian/permissions.ex and program routines 'Elixir.Guardian.Permissions':encode_permissions!/1, 'Elixir.Guardian.Permissions':encode_permissions_into_claims!/2, 'Elixir.Guardian.Permissions':do_encode_permissions!/2. The Guardian.Permissions mixin installs a public encode_permissions!/1 function on every module that does use Guardian.Permissions. For each key of the supplied map, encode_permissions!/1 calls String.to_atom(to_string(k)) before any validation runs. The integer-value clause of do_encode_permissions!/2 then short-circuits straight to encoding without validating the key against the configured permission set, so a key with an integer value is interned as a fresh atom with no exception raised. Atoms are never garbage collected and the BEAM atom table is a fixed-size resource (default roughly 1,048,576 entries), so each unique attacker-chosen key permanently consumes one slot. An attacker who can influence a permission map that reaches encode_permissions!/1 (for example a permissions map read from a request body and passed into token issuance via encode_permissions_into_claims!/2) can mint an unbounded number of atoms and exhaust the atom table, crashing the entire BEAM node and every service running on it. The sibling decode_permissions/1 is not affected because it skips keys absent from the configured permission set. This issue affects guardian: from 2.0.0 before 2.4.1.

Published

Date2026-08-01

Updated

Date2026-08-01

RISK INFORMATION (Score: )

cvss4

Base Score: 6.9

Complexity: LOW

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

CVE-2026-55733

SUMMARY

Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom creation from attacker-controlled binary input. Guardian.Permissions.AtomEncoding encodes permission scopes by passing arbitrary binaries to String.to_atom/1. When encode/3 in lib/guardian/permissions/atom_encoding.ex is called with a list, each binary entry is handled by the encode_value/3 binary clause, which calls String.to_atom(value) with no allow-list check. The perm_set argument (the application's small, finite set of legitimate permission names) is discarded, so any external string flows straight into atom creation. This encoder is selected with use Guardian.Permissions, encoding: Guardian.Permissions.AtomEncoding and reached through the imported encode/3 entry point. String.to_atom/1 creates a brand-new atom for every previously unseen binary, atoms are never garbage collected, and the BEAM atom table is fixed at roughly 1,048,576 entries by default. An application that funnels attacker-influenced permission scopes (from a request body, a JWT claim, or other external input) into encode/3 therefore mints one permanent atom per distinct value. A modest stream of varied, unauthenticated input permanently consumes the atom table and crashes the BEAM node with system_limit, taking down every application running on it. The default encoder is Guardian.Permissions.BitwiseEncoding, which is not affected. This issue affects guardian: from 2.0.0 before 2.4.1.

Published

Date2026-08-01

Updated

Date2026-08-01

RISK INFORMATION (Score: )

cvss4

Base Score: 6.9

Complexity: LOW

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

CVE-2026-54894

SUMMARY

Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom creation from attacker-influenced binary input. Guardian.Plug.Keys derives connection and session namespace keys by passing arbitrary binaries to String.to_atom/1. base_key/1 in lib/guardian/plug/keys.ex converts any binary into the atom :"guardian_<input>", and the derived helpers claims_key/1, resource_key/1, and token_key/1 create a second atom on top of that. key_from_other/1 likewise converts a regex-captured binary through String.to_atom/1. The public specs advertise String.t() as a valid argument, so passing a string is documented usage, and higher-level entry points such as Guardian.Plug.current_token(conn, key: key) thread the caller-supplied key straight into these functions. String.to_atom/1 creates a brand-new atom for every previously unseen binary, atoms are never garbage collected, and the BEAM atom table is fixed at roughly 1,048,576 entries by default. An application that routes attacker-influenced data (a tenant identifier, header, or other request input) into a Guardian key therefore mints one permanent atom per distinct value. A modest stream of varied, unauthenticated input permanently consumes the atom table and crashes the BEAM node, taking down every application running on it. This issue affects guardian: from 0.1.0 before 2.4.1.

Published

Date2026-08-01

Updated

Date2026-08-01

RISK INFORMATION (Score: )

cvss4

Base Score: 6.9

Complexity: LOW

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

Loading…

API

Access Data Using Our API

Get company history

curl -i -X GET 'https://api.rankiteo.com/underwriter-getcompany-history?
linkedin_id=axa' -H 'apikey: YOUR_API_KEY_HERE'

Try It API Documentation Rapid

MEASURE

What Do We Measure ?

Incident

Finding

Grade

Digital Assets

Every week, Rankiteo analyzes billions of signals to give organizations a sharper, faster view of emerging risks. With deeper, more actionable intelligence at their fingertips, security teams can outpace threat actors, respond instantly to Zero-Day attacks, and dramatically shrink their risk exposure window.

These are some of the factors we use to calculate the overall score:

Network SecurityIdentify exposed access points, detect misconfigured SSL certificates, and uncover vulnerabilities across the network infrastructure.

SBOM (Software Bill of Materials)Gain visibility into the software components used within an organization to detect vulnerabilities, manage risk, and ensure supply chain security.

CMDB (Configuration Management Database)Monitor and manage all IT assets and their configurations to ensure accurate, real-time visibility across the company's technology environment.

Threat IntelligenceLeverage real-time insights on active threats, malware campaigns, and emerging vulnerabilities to proactively defend against evolving cyberattacks.

Rankiteo

By Rankiteo

★ ★ ★ ★ ★

View on G2.com

Rankiteo is a unified scoring and risk platform that analyzes billions of signals weekly to help organizations gain faster, more actionable insights into emerging threats. Empowering teams to outpace adversaries and reduce exposure.

View latest plans →View all security reports →

MILESTONEG

Users
Love Us

Loading…