CVE-2026-49249

Boruta is a standalone authorization server that aims to implement OAuth 2.0 and Openid Connect up to decentralized identity specifications. Prior to version 0.10.0, BorutaIdentityWeb.UserSettingsController.update/2 atomizes every key of the user-supplied request body via String.to_atom/1 before any validation. Because String.to_atom interns atoms permanently in the BEAM atom table (default cap 1,048,576 atoms; ERL_MAX_ATOMS), any authenticated end user can send PUT /users/settings with a user[<fresh-key>]=... body containing fresh keys per request and exhaust the global VM atom table. Once the table is full, the BEAM aborts with no more index entries in atom_tab and the entire OIDC server (auth, admin, gateway apps in the umbrella) crashes. The route is protected only by require_authenticated_user and a per-IP rate limit of 10 requests/second; a logged-in end user can hit it. The keys are atomized unconditionally before the downstream Accounts.update_user/6 call, so even failing updates contribute to exhaustion. This issue has been patched in version 0.10.0.

• CWE-400
• CWE-770

• https://github.com/malach-it/boruta-server/releases/tag/0.10.0
• https://github.com/malach-it/boruta-server/security/advisories/GHSA-q428-ch8m-94gg
• https://github.com/malach-it/boruta-server/security/advisories/GHSA-q428-ch8m-94gg

Published

Sep 2, 2026

Last Modified

Sep 9, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-49241The Angular Language Service VS Code Extension provides a ri…8.8
• CVE-2026-49244SFTPGo is an open source, event-driven file transfer solutio…5.9
• CVE-2026-49245SFTPGo is an open source, event-driven file transfer solutio…3.7
• CVE-2026-49246Jellyfin is an open source self hosted media server. Prior t…1.7
• CVE-2026-49247Jellyfin is an open source self hosted media server. From 10…8.8
• CVE-2026-49248OneDev is a Git server with CI/CD, kanban, and packages. In …8.3
• CVE-2026-4925Improper access control in the users MFA feature in Devoluti…5
• CVE-2026-49250Conform, a type-safe form validation library, allows the par…8.7
• CVE-2026-49252deepstream is a server that allows clients and backend servi…9.9
• CVE-2026-49253electerm is an open-sourced terminal/ssh/sftp/telnet/serialp…7.1
• CVE-2026-49254Dragonfly is an open source P2P-based file distribution and …2.9
• CVE-2026-49255electerm is an open-sourced terminal/ssh/sftp/telnet/serialp…8.8