CVE-2026-49249

CVE-2026-49249 is an uncontrolled resource consumption flaw (CWE-400/CWE-770) in Boruta, a standalone open-source authorization server implementing OAuth 2.0 and OpenID Connect: before version 0.10.0, BorutaIdentityWeb.UserSettingsController.update/2 converts every key of the user-supplied request body to an atom via String.to_atom/1, which permanently interns atoms in the Erlang VM's global atom table (default cap 1,048,576 atoms). Any authenticated end user can trigger it by repeatedly sending PUT /users/settings with fresh user[<key>]=... parameters; keys are atomized before validation, so even updates that fail downstream still consume table entries, and the only protections are authentication plus a per-IP rate limit of 10 requests/second. The impact is total denial of service with no confidentiality or integrity loss: once the table fills, the BEAM aborts with 'no more index entries in atom_tab' and crashes the entire umbrella application, including the auth, admin, and gateway apps. Only Boruta deployments running versions prior to 0.10.0 that expose the user settings endpoint to logged-in end users are affected. No public proof-of-concept or in-the-wild exploitation is known; EPSS estimates a 0.2% probability of exploitation in the next 30 days, and the issue is not in CISA KEV.

What to do: Upgrade Boruta to version 0.10.0 or later, which stops permanently interning user-supplied keys. Until you can upgrade, restrict PUT /users/settings to trusted accounts and tighten rate limiting or filter/reject requests with large numbers of user[...] parameter keys at a reverse proxy, since the default 10 req/s per-IP limit only delays exhaustion; monitoring the BEAM atom count (e.g., via erlang:system_info(atom_count) and the ERL_MAX_ATOMS cap) and restarting the node can serve as a stopgap. Given no known exploitation, treat this as a routine priority patch.