High · CVSS 7.1CVE-2026-49249

Boruta: Authenticated atom-exhaustion DoS in BorutaIdentityWeb.UserSettingsController.update/2CVE-2026-49249

Answer in brief

CVE-2026-49249 records a High severity (CVSS 7.1) vulnerability in Boruta: Authenticated atom-exhaustion DoS in BorutaIdentityWeb.UserSettingsController.update/2. The current sources do not mark it as known exploited. The current feed maps malach-it/boruta-server (generic). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Sep 2, 2026Updated Sep 9, 2026Source checked Oct 17, 2026First seen by HOL Sep 2, 2026Material review Sep 9, 2026

Upstream Advisory

Key facts

Risk: High · CVSS 7.1
Exploitation: Not marked as known exploited
Affected software: 1 mapped package or product
Fix availability: Available

Why this deserves its current priority

CVSS is 7.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps malach-it/boruta-server (generic). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
malach-it/boruta-servergeneric	<0.10.0	0.10.0

Recommended response

Check inventory. Check lockfiles and deployed manifests for malach-it/boruta-server.
Review the reported fix. Update malach-it/boruta-server to 0.10.0 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Sep 2, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Sep 9, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Sep 2, 2026

Sources and claim methodology

Upstream source description

Boruta is a standalone authorization server that aims to implement OAuth 2.0 and Openid Connect up to decentralized identity specifications. Prior to version 0.10.0, BorutaIdentityWeb.UserSettingsController.update/2 atomizes every key of the user-supplied request body via String.to_atom/1 before any validation. Because String.to_atom interns atoms permanently in the BEAM atom table (default cap 1,048,576 atoms; ERL_MAX_ATOMS), any authenticated end user can send PUT /users/settings with a user[<fresh-key>]=... body containing fresh keys per request and exhaust the global VM atom table. Once the table is full, the BEAM aborts with no more index entries in atom_tab and the entire OIDC server (auth, admin, gateway apps in the umbrella) crashes. The route is protected only by require_authenticated_user and a per-IP rate limit of 10 requests/second; a logged-in end user can hit it. The keys are atomized unconditionally before the downstream Accounts.update_user/6 call, so even failing updates contribute to exhaustion. This issue has been patched in version 0.10.0.

Quoted source text, attributed separately from HOL analysis.