Is CVE-2026-49249 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-49249 being exploited in the wild.

How severe is CVE-2026-49249?

Informational severity, with a CVSS score of 7.1, published 2 September 2026.

Is there a fix for CVE-2026-49249?

A patch was published on 2026-06-12: Version 0.10.0 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-49249 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-49249?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-49249: Boruta atom exhaustion denial of service in UserSettingsController

CVE-2026-49249 · Severity: info · CVSS 7.1 · Published 2026-09-02

Boruta is an OAuth 2.0 and OpenID Connect authorization server used to provide authentication and identity services. An authenticated user can crash the entire Boruta server by submitting specially crafted requests with arbitrary keys, exhausting the BEAM virtual machine's atom table and causing a complete denial of service to all OAuth/OIDC endpoints, admin interfaces, and user identity services until the server restarts.

Quick answers

Is CVE-2026-49249 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-49249 being exploited in the wild.
How severe is CVE-2026-49249?: Informational severity, with a CVSS score of 7.1, published 2 September 2026.
Which products and versions are affected?: Boruta Boruta 0.2.0 to 0.9.1.
Is there a fix for CVE-2026-49249?: A patch was published on 2026-06-12: Version 0.10.0 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-49249 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-49249?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a denial-of-service flaw in Boruta's UserSettingsController.update/2 endpoint that atomizes every key from the user-supplied PUT /users/settings request body via String.to_atom/1 before any validation. Because Erlang atoms are interned permanently in the BEAM atom table (default cap 1,048,576), an authenticated user can send requests with fresh keys (e.g., user[fresh_key_N]=value) to exhaust the table. The route is protected only by require_authenticated_user and a per-IP rate limit of 10 req/s; atomization occurs before Ecto/Spark validation, so even failed updates consume atoms. With ~25 bytes per key and a 1MB default Plug body size limit, an attacker can intern ~400,000 atoms per second, exhausting the table in 3–5 seconds. Once exhausted, the BEAM VM aborts with "no more index entries in atom_tab" and crashes the entire Boruta umbrella (auth, admin, gateway, identity apps), persisting until restart. The issue is patched in version 0.10.0.

Affected products

Boruta Boruta 0.2.0 to 0.9.1

Timeline

2026-06-01: disclosed: GHSA advisory published
2026-06-12: patched: Version 0.10.0 released with fix
2026-09-02: advisory: CVE-2026-49249 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.