CVE-2026-49249: Boruta: Authenticated atom-exhaustion DoS in BorutaIdentityWeb.UserSettingsController.update/2

Q: Who can exploit this issue?

Any authenticated Boruta end user can exploit it. The affected endpoint requires only a logged-in user session; no administrative privileges are described.

Q: Does an attacker need to submit valid settings updates?

No. Request-body keys are converted to atoms before validation and before the downstream update call, so failed updates still consume atom-table entries. An attacker can use fresh user[<fresh-key>] parameter names in PUT requests to /users/settings.

Published Sep 2, 2026

Updated

Boruta is a standalone authorization server that aims to implement OAuth 2.0 and Openid Connect up to decentralized identity specifications. Prior to version 0.10.0, BorutaIdentityWeb.UserSettingsController.update/2 atomizes every key of the user-supplied request body via String.toatom/1 before any validation. Because String.toatom interns atoms permanently in the BEAM atom table (default cap 1,048,576 atoms; ERLMAXATOMS), any authenticated end user can send PUT /users/settings with a user[<fresh-key>]=... body containing fresh keys per request and exhaust the global VM atom table. Once the table is full, the BEAM aborts with no more index entries in atomtab and the entire OIDC server (auth, admin, gateway apps in the umbrella) crashes. The route is protected only by requireauthenticateduser and a per-IP rate limit of 10 requests/second; a logged-in end user can hit it. The keys are atomized unconditionally before the downstream Accounts.updateuser/6 call, so even failing updates contribute to exhaustion. This issue has been patched in version 0.10.0.

Affected Software

1 affected component

Boruta<0.10.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade BorutaIdentityWeb.UserSettingsController.update/2 (Boruta OIDC server) to a version that resolves this vulnerability.
Fixed in 0.10.0
Compensating control
Reduce exposure of the atom-exhaustion DoS endpoint (PUT /users/settings, handled by BorutaIdentityWeb.UserSettingsController.update/2) by tightening access controls beyond only require_authenticated_user and the existing per-IP limit of 10 requests/second (e.g., restrict to only trusted clients/roles).

Event History

Sep 2, 2026

CVE Published

via MITRE·05:28 PM

Data Sourced

via MITRE·05:28 PM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

Any authenticated Boruta end user can exploit it. The affected endpoint requires only a logged-in user session; no administrative privileges are described.

Does an attacker need to submit valid settings updates?

No. Request-body keys are converted to atoms before validation and before the downstream update call, so failed updates still consume atom-table entries. An attacker can use fresh user[<fresh-key>] parameter names in PUT requests to /users/settings.

How broadly does a successful attack affect a deployment?

Exhausting the global BEAM atom table causes the BEAM VM to abort. This crashes the entire OIDC server, including the auth, admin, and gateway applications in the umbrella.

Are rate limits sufficient mitigation?

The endpoint has a per-IP limit of 10 requests per second, but the issue remains exploitable by a logged-in end user because each request can introduce fresh keys. The provided data identifies upgrading to version 0.10.0 as the patch.