CVE-2026-49249: CWE-400: Uncontrolled Resource Consumption in malach-it boruta-server
Description
Boruta is a standalone authorization server that aims to implement OAuth 2.0 and Openid Connect up to decentralized identity specifications. Prior to version 0.10.0, BorutaIdentityWeb.UserSettingsController.update/2 atomizes every key of the user-supplied request body via String.to_atom/1 before any validation. Because String.to_atom interns atoms permanently in the BEAM atom table (default cap 1,048,576 atoms; ERL_MAX_ATOMS), any authenticated end user can send PUT /users/settings with a user[<fresh-key>]=... body containing fresh keys per request and exhaust the global VM atom table. Once the table is full, the BEAM aborts with no more index entries in atom_tab and the entire OIDC server (auth, admin, gateway apps in the umbrella) crashes. The route is protected only by require_authenticated_user and a per-IP rate limit of 10 requests/second; a logged-in end user can hit it. The keys are atomized unconditionally before the downstream Accounts.update_user/6 call, so even failing updates contribute to exhaustion. This issue has been patched in version 0.10.0.
CVSS v4.0
Score 7.1high
Affected software
malach-it
boruta-server
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Boruta-server versions before 0.10.0 contain a resource exhaustion vulnerability in the UserSettingsController.update/2 function. This function converts every key in the user-supplied request body to an atom using String.to_atom/1 before validation. Since atoms are permanently stored in the BEAM VM atom table with a fixed maximum size, an attacker with authenticated access can send requests with unique keys to exhaust this table. Once full, the BEAM VM crashes with an 'no more index entries in atom_tab' error, causing the entire OIDC server umbrella (including auth, admin, and gateway apps) to crash. The route is protected by authentication and a per-IP rate limit of 10 requests/second, but this does not prevent an authenticated user from exploiting the vulnerability. The issue is fixed in boruta-server version 0.10.0.
Potential Impact
An authenticated user can cause a denial of service by exhausting the BEAM VM atom table through repeated requests with unique keys, leading to a crash of the entire OIDC server umbrella. This disrupts authorization, administration, and gateway services dependent on boruta-server, impacting availability.
Mitigation Recommendations
This vulnerability is patched in boruta-server version 0.10.0. Users should upgrade to version 0.10.0 or later to remediate the issue. No other mitigations are indicated in the vendor advisory. Patch status is not explicitly confirmed beyond the stated fix version; verify with vendor advisory for current guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-28T14:33:01.178Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a986026acd9273b498885a0
Added to database: 09/02/2026, 17:43:02 UTC
Last enriched: 09/07/2026, 13:25:43 UTC
Last updated: 10/15/2026, 18:48:21 UTC
Views: 84
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.