CVE-2026-49249

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-49249
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-49249.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-49249
Aliases
  • GHSA-q428-ch8m-94gg
Published
2026-09-02T17:28:32.280Z
Modified
2026-09-04T03:47:30.207935853Z
Severity
  • 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Boruta: Authenticated atom-exhaustion DoS in BorutaIdentityWeb.UserSettingsController.update/2
Details

Boruta is a standalone authorization server that aims to implement OAuth 2.0 and Openid Connect up to decentralized identity specifications. Prior to version 0.10.0, BorutaIdentityWeb.UserSettingsController.update/2 atomizes every key of the user-supplied request body via String.toatom/1 before any validation. Because String.toatom interns atoms permanently in the BEAM atom table (default cap 1,048,576 atoms; ERLMAXATOMS), any authenticated end user can send PUT /users/settings with a user[<fresh-key>]=... body containing fresh keys per request and exhaust the global VM atom table. Once the table is full, the BEAM aborts with no more index entries in atomtab and the entire OIDC server (auth, admin, gateway apps in the umbrella) crashes. The route is protected only by requireauthenticateduser and a per-IP rate limit of 10 requests/second; a logged-in end user can hit it. The keys are atomized unconditionally before the downstream Accounts.updateuser/6 call, so even failing updates contribute to exhaustion. This issue has been patched in version 0.10.0.

Database specific 
{
    "cwe_ids": [
        "CWE-400",
        "CWE-770"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49249.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/malach-it/boruta-server

Affected ranges

Type
GIT
Repo
https://github.com/malach-it/boruta-server
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
6636da08934cd4aea5e19a0147b9e111a6fb3635
Database specific
Show details 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.10.0"
        }
    ]
}

Affected versions

0.*
0.1.0
0.2.0
0.3.0
0.4.0
0.4.1
0.4.2
0.5.0
0.5.1
0.6.0
0.6.1
0.7.0
0.7.1
0.7.2
0.8.0
0.9.0
0.9.1
0.9.2
Other
Initial

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-49249.json"