{"resultsPerPage":6,"startIndex":0,"totalResults":6,"format":"NVD_CVE","version":"2.0","timestamp":"2026-08-02T08:58:02.499","vulnerabilities":[{"cve":{"id":"CVE-2024-10918","sourceIdentifier":"prodsec@nozominetworks.com","published":"2025-02-27T12:15:33.807","lastModified":"2026-08-01T19:16:41.023","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Stack-based Buffer Overflow vulnerability in libmodbus v3.1.10 allows to overflow the buffer allocated for the Modbus response if the function tries to reply to a Modbus request with an\nunexpected length."},{"lang":"es","value":"La vulnerabilidad de desbordamiento de búfer basada en pila en libmodbus v3.1.10 permite desbordar el búfer asignado para la respuesta Modbus si la función intenta responder a una solicitud Modbus con una longitud inesperada."}],"affected":[{"source":"prodsec@nozominetworks.com","affectedData":[{"vendor":"libmodbus","product":"libmodbus","defaultStatus":"unaffected","collectionURL":"https://libmodbus.org/","modules":["modbus"],"programFiles":["modbus.c"],"programRoutines":[{"name":"modbus_reply"}],"repo":"https://github.com/stephane/libmodbus","versions":[{"version":"0","lessThanOrEqual":"3.1.10","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"prodsec@nozominetworks.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.2,"impactScore":2.5},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-02-27T14:46:41.226453Z","id":"CVE-2024-10918","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"prodsec@nozominetworks.com","type":"Secondary","description":[{"lang":"en","value":"CWE-121"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-787"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:libmodbus:libmodbus:3.1.10:*:*:*:*:*:*:*","matchCriteriaId":"524EB0BF-4994-4369-BD85-CC578548CA1C"}]}]}],"references":[{"url":"https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-10918","source":"prodsec@nozominetworks.com","tags":["Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/03/msg00010.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2026/08/msg00003.html","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2025-52936","sourceIdentifier":"cve_disclosure@tech.gov.sg","published":"2025-06-23T10:15:27.570","lastModified":"2026-08-01T19:16:41.817","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Link Resolution Before File Access ('Link Following') vulnerability in yrutschle sslh.This issue affects sslh: before 2.2.2."},{"lang":"es","value":"Vulnerabilidad de resolución de enlace incorrecta antes del acceso a archivos ('Seguimiento de enlace') en yrutschle sslh. Este problema afecta a sslh: anteriores a 2.2.2. "}],"affected":[{"source":"cve_disclosure@tech.gov.sg","affectedData":[{"vendor":"yrutschle","product":"sslh","defaultStatus":"unaffected","repo":"https://github.com/yrutschle/sslh","versions":[{"version":"0","lessThan":"2.2.2","versionType":"git","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cve_disclosure@tech.gov.sg","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:M/U:Amber","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"LOW","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NEGLIGIBLE","Automatable":"YES","Recovery":"USER","valueDensity":"CONCENTRATED","vulnerabilityResponseEffort":"MODERATE","providerUrgency":"AMBER"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-06-23T13:27:09.374416Z","id":"CVE-2025-52936","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve_disclosure@tech.gov.sg","type":"Secondary","description":[{"lang":"en","value":"CWE-59"}]}],"references":[{"url":"https://github.com/yrutschle/sslh/pull/494","source":"cve_disclosure@tech.gov.sg"},{"url":"https://lists.debian.org/debian-lts-announce/2025/07/msg00001.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2026/08/msg00004.html","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2026-54894","sourceIdentifier":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","published":"2026-08-01T19:16:41.977","lastModified":"2026-08-01T19:16:41.977","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom creation from attacker-influenced binary input.\n\nGuardian.Plug.Keys derives connection and session namespace keys by passing arbitrary binaries to String.to_atom/1. base_key/1 in lib/guardian/plug/keys.ex converts any binary into the atom :\"guardian_<input>\", and the derived helpers claims_key/1, resource_key/1, and token_key/1 create a second atom on top of that. key_from_other/1 likewise converts a regex-captured binary through String.to_atom/1. The public specs advertise String.t() as a valid argument, so passing a string is documented usage, and higher-level entry points such as Guardian.Plug.current_token(conn, key: key) thread the caller-supplied key straight into these functions.\n\nString.to_atom/1 creates a brand-new atom for every previously unseen binary, atoms are never garbage collected, and the BEAM atom table is fixed at roughly 1,048,576 entries by default. An application that routes attacker-influenced data (a tenant identifier, header, or other request input) into a Guardian key therefore mints one permanent atom per distinct value. A modest stream of varied, unauthenticated input permanently consumes the atom table and crashes the BEAM node, taking down every application running on it.\n\nThis issue affects guardian: from 0.1.0 before 2.4.1."}],"affected":[{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","affectedData":[{"vendor":"ueberauth","product":"guardian","defaultStatus":"unaffected","collectionURL":"https://repo.hex.pm","packageName":"guardian","cpes":["cpe:2.3:a:ueberauth:guardian:*:*:*:*:*:*:*:*"],"modules":["'Elixir.Guardian.Plug.Keys'"],"programFiles":["lib/guardian/plug/keys.ex"],"programRoutines":[{"name":"'Elixir.Guardian.Plug.Keys':base_key/1"},{"name":"'Elixir.Guardian.Plug.Keys':claims_key/1"},{"name":"'Elixir.Guardian.Plug.Keys':resource_key/1"},{"name":"'Elixir.Guardian.Plug.Keys':token_key/1"},{"name":"'Elixir.Guardian.Plug.Keys':key_from_other/1"}],"repo":"https://github.com/ueberauth/guardian","packageURL":"pkg:hex/guardian","versions":[{"version":"0.1.0","lessThan":"2.4.1","versionType":"semver","status":"affected"}]},{"vendor":"ueberauth","product":"guardian","defaultStatus":"unaffected","collectionURL":"https://github.com","packageName":"ueberauth/guardian","cpes":["cpe:2.3:a:ueberauth:guardian:*:*:*:*:*:*:*:*"],"modules":["'Elixir.Guardian.Plug.Keys'"],"programFiles":["lib/guardian/plug/keys.ex"],"programRoutines":[{"name":"'Elixir.Guardian.Plug.Keys':base_key/1"},{"name":"'Elixir.Guardian.Plug.Keys':claims_key/1"},{"name":"'Elixir.Guardian.Plug.Keys':resource_key/1"},{"name":"'Elixir.Guardian.Plug.Keys':token_key/1"},{"name":"'Elixir.Guardian.Plug.Keys':key_from_other/1"}],"repo":"https://github.com/ueberauth/guardian","packageURL":"pkg:github/ueberauth/guardian","versions":[{"version":"7126fa433afc2563fcac0c9aa35193965f8fd5f8","lessThan":"2952657e42e6341a67e6aaad09d8f0b40ae917cb","versionType":"git","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}]},"weaknesses":[{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary","description":[{"lang":"en","value":"CWE-770"}]}],"references":[{"url":"https://cna.erlef.org/cves/CVE-2026-54894.html","source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"},{"url":"https://github.com/ueberauth/guardian/commit/2952657e42e6341a67e6aaad09d8f0b40ae917cb","source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"},{"url":"https://github.com/ueberauth/guardian/security/advisories/GHSA-xqch-c77q-rgh5","source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"},{"url":"https://osv.dev/vulnerability/EEF-CVE-2026-54894","source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}]}},{"cve":{"id":"CVE-2026-55733","sourceIdentifier":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","published":"2026-08-01T19:16:42.157","lastModified":"2026-08-01T19:16:42.157","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom creation from attacker-controlled binary input.\n\nGuardian.Permissions.AtomEncoding encodes permission scopes by passing arbitrary binaries to String.to_atom/1. When encode/3 in lib/guardian/permissions/atom_encoding.ex is called with a list, each binary entry is handled by the encode_value/3 binary clause, which calls String.to_atom(value) with no allow-list check. The perm_set argument (the application's small, finite set of legitimate permission names) is discarded, so any external string flows straight into atom creation. This encoder is selected with use Guardian.Permissions, encoding: Guardian.Permissions.AtomEncoding and reached through the imported encode/3 entry point.\n\nString.to_atom/1 creates a brand-new atom for every previously unseen binary, atoms are never garbage collected, and the BEAM atom table is fixed at roughly 1,048,576 entries by default. An application that funnels attacker-influenced permission scopes (from a request body, a JWT claim, or other external input) into encode/3 therefore mints one permanent atom per distinct value. A modest stream of varied, unauthenticated input permanently consumes the atom table and crashes the BEAM node with system_limit, taking down every application running on it.\n\nThe default encoder is Guardian.Permissions.BitwiseEncoding, which is not affected.\n\nThis issue affects guardian: from 2.0.0 before 2.4.1."}],"affected":[{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","affectedData":[{"vendor":"ueberauth","product":"guardian","defaultStatus":"unaffected","collectionURL":"https://repo.hex.pm","packageName":"guardian","cpes":["cpe:2.3:a:ueberauth:guardian:*:*:*:*:*:*:*:*"],"modules":["'Elixir.Guardian.Permissions.AtomEncoding'"],"programFiles":["lib/guardian/permissions/atom_encoding.ex"],"programRoutines":[{"name":"'Elixir.Guardian.Permissions.AtomEncoding':encode/3"},{"name":"'Elixir.Guardian.Permissions.AtomEncoding':encode_value/3"}],"repo":"https://github.com/ueberauth/guardian","packageURL":"pkg:hex/guardian","versions":[{"version":"2.0.0","lessThan":"2.4.1","versionType":"semver","status":"affected"}]},{"vendor":"ueberauth","product":"guardian","defaultStatus":"unaffected","collectionURL":"https://github.com","packageName":"ueberauth/guardian","cpes":["cpe:2.3:a:ueberauth:guardian:*:*:*:*:*:*:*:*"],"modules":["'Elixir.Guardian.Permissions.AtomEncoding'"],"programFiles":["lib/guardian/permissions/atom_encoding.ex"],"programRoutines":[{"name":"'Elixir.Guardian.Permissions.AtomEncoding':encode/3"},{"name":"'Elixir.Guardian.Permissions.AtomEncoding':encode_value/3"}],"repo":"https://github.com/ueberauth/guardian","packageURL":"pkg:github/ueberauth/guardian","versions":[{"version":"b7a6128ca4d0ffb7f7df5219dd982304ff9d6802","lessThan":"9cd268557846aa4c3ad53566c08f2c190ee5513f","versionType":"git","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}]},"weaknesses":[{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary","description":[{"lang":"en","value":"CWE-770"}]}],"references":[{"url":"https://cna.erlef.org/cves/CVE-2026-55733.html","source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"},{"url":"https://github.com/ueberauth/guardian/commit/9cd268557846aa4c3ad53566c08f2c190ee5513f","source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"},{"url":"https://github.com/ueberauth/guardian/security/advisories/GHSA-fjr5-7xrc-hmpj","source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"},{"url":"https://osv.dev/vulnerability/EEF-CVE-2026-55733","source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}]}},{"cve":{"id":"CVE-2026-55734","sourceIdentifier":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","published":"2026-08-01T19:16:42.333","lastModified":"2026-08-01T19:16:42.333","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"Allocation of Resources Without Limits or Throttling vulnerability in ueberauth guardian (Guardian.Permissions module) allows a denial of service via BEAM atom-table exhaustion.\n\nThis vulnerability is associated with program file lib/guardian/permissions.ex and program routines 'Elixir.Guardian.Permissions':encode_permissions!/1, 'Elixir.Guardian.Permissions':encode_permissions_into_claims!/2, 'Elixir.Guardian.Permissions':do_encode_permissions!/2.\n\nThe Guardian.Permissions mixin installs a public encode_permissions!/1 function on every module that does use Guardian.Permissions. For each key of the supplied map, encode_permissions!/1 calls String.to_atom(to_string(k)) before any validation runs. The integer-value clause of do_encode_permissions!/2 then short-circuits straight to encoding without validating the key against the configured permission set, so a key with an integer value is interned as a fresh atom with no exception raised. Atoms are never garbage collected and the BEAM atom table is a fixed-size resource (default roughly 1,048,576 entries), so each unique attacker-chosen key permanently consumes one slot. An attacker who can influence a permission map that reaches encode_permissions!/1 (for example a permissions map read from a request body and passed into token issuance via encode_permissions_into_claims!/2) can mint an unbounded number of atoms and exhaust the atom table, crashing the entire BEAM node and every service running on it. The sibling decode_permissions/1 is not affected because it skips keys absent from the configured permission set.\n\nThis issue affects guardian: from 2.0.0 before 2.4.1."}],"affected":[{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","affectedData":[{"vendor":"ueberauth","product":"guardian","defaultStatus":"unaffected","collectionURL":"https://repo.hex.pm","packageName":"guardian","cpes":["cpe:2.3:a:ueberauth:guardian:*:*:*:*:*:*:*:*"],"modules":["'Elixir.Guardian.Permissions'"],"programFiles":["lib/guardian/permissions.ex"],"programRoutines":[{"name":"'Elixir.Guardian.Permissions':encode_permissions!/1"},{"name":"'Elixir.Guardian.Permissions':encode_permissions_into_claims!/2"},{"name":"'Elixir.Guardian.Permissions':do_encode_permissions!/2"}],"repo":"https://github.com/ueberauth/guardian","packageURL":"pkg:hex/guardian","versions":[{"version":"2.0.0","lessThan":"2.4.1","versionType":"semver","status":"affected"}]},{"vendor":"ueberauth","product":"guardian","defaultStatus":"unaffected","collectionURL":"https://github.com","packageName":"ueberauth/guardian","cpes":["cpe:2.3:a:ueberauth:guardian:*:*:*:*:*:*:*:*"],"modules":["'Elixir.Guardian.Permissions'"],"programFiles":["lib/guardian/permissions.ex"],"programRoutines":[{"name":"'Elixir.Guardian.Permissions':encode_permissions!/1"},{"name":"'Elixir.Guardian.Permissions':encode_permissions_into_claims!/2"},{"name":"'Elixir.Guardian.Permissions':do_encode_permissions!/2"}],"repo":"https://github.com/ueberauth/guardian","packageURL":"pkg:github/ueberauth/guardian","versions":[{"version":"b7a6128ca4d0ffb7f7df5219dd982304ff9d6802","lessThan":"8d4efbfc352d30f5fcfc75a4d69a795b0e472724","versionType":"git","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}]},"weaknesses":[{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary","description":[{"lang":"en","value":"CWE-770"}]}],"references":[{"url":"https://cna.erlef.org/cves/CVE-2026-55734.html","source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"},{"url":"https://github.com/ueberauth/guardian/commit/8d4efbfc352d30f5fcfc75a4d69a795b0e472724","source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"},{"url":"https://github.com/ueberauth/guardian/security/advisories/GHSA-9qx2-v587-q3gg","source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"},{"url":"https://osv.dev/vulnerability/EEF-CVE-2026-55734","source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}]}},{"cve":{"id":"CVE-2026-55735","sourceIdentifier":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","published":"2026-08-01T19:16:42.510","lastModified":"2026-08-01T19:16:42.510","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Verification of Cryptographic Signature in ueberauth guardian allows an unauthenticated attacker to revoke a victim's session with a forged token.\n\nGuardian.revoke/3 in lib/guardian.ex decodes the supplied token with peek/1, which performs no signature verification (it only base64-decodes the JWT header and payload). The resulting unverified claims are forwarded directly to the configured token module's revoke callback and the implementation's on_revoke callback, a state-mutating sink. The sibling operations refresh/2 and exchange/4 both call decode_and_verify first, so the signature is checked before anything acts on the claims; revoke/3 is the only state-mutating path that acts on claims without verifying the signature.\n\nAn attacker who knows or guesses a victim's identifying claim values (jti, sub) can forge a JWT carrying those claims, sign it with an arbitrary key, and submit it to any endpoint that funnels a caller-supplied token into Guardian.revoke/3 (the standard logout / session-revocation pattern). When the token module mutates state keyed by the claims (whitelist deletion or blacklist insertion, for example a GuardianDb-style store), the victim's legitimate session is evicted. This is an unauthenticated session-revocation denial of service; the attacker never needs the signing secret.\n\nThis issue affects guardian: from 1.0.0 before 2.4.1."}],"affected":[{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","affectedData":[{"vendor":"ueberauth","product":"guardian","defaultStatus":"unaffected","collectionURL":"https://repo.hex.pm","packageName":"guardian","cpes":["cpe:2.3:a:ueberauth:guardian:*:*:*:*:*:*:*:*"],"modules":["'Elixir.Guardian'"],"programFiles":["lib/guardian.ex"],"programRoutines":[{"name":"'Elixir.Guardian':revoke/3"}],"repo":"https://github.com/ueberauth/guardian","packageURL":"pkg:hex/guardian","versions":[{"version":"1.0.0","lessThan":"2.4.1","versionType":"semver","status":"affected"}]},{"vendor":"ueberauth","product":"guardian","defaultStatus":"unaffected","collectionURL":"https://github.com","packageName":"ueberauth/guardian","cpes":["cpe:2.3:a:ueberauth:guardian:*:*:*:*:*:*:*:*"],"modules":["'Elixir.Guardian'"],"programFiles":["lib/guardian.ex"],"programRoutines":[{"name":"'Elixir.Guardian':revoke/3"}],"repo":"https://github.com/ueberauth/guardian","packageURL":"pkg:github/ueberauth/guardian","versions":[{"version":"d65227145f72b290106c06cecbe42728fbf05fe2","lessThan":"2bd7a8c29770d423d855c0a4965caa6c3e486901","versionType":"git","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}]},"weaknesses":[{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary","description":[{"lang":"en","value":"CWE-347"}]}],"references":[{"url":"https://cna.erlef.org/cves/CVE-2026-55735.html","source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"},{"url":"https://github.com/ueberauth/guardian/commit/2bd7a8c29770d423d855c0a4965caa6c3e486901","source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"},{"url":"https://github.com/ueberauth/guardian/security/advisories/GHSA-7975-hp3r-5qhv","source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"},{"url":"https://osv.dev/vulnerability/EEF-CVE-2026-55735","source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}]}}]}