Executive brief
Boruta is an OAuth 2.0 and OpenID Connect authorization server used to provide authentication and identity services. An authenticated user can crash the entire Boruta server by submitting specially crafted requests with arbitrary keys, exhausting the BEAM virtual machine's atom table and causing a complete denial of service to all OAuth/OIDC endpoints, admin interfaces, and user identity services until the server restarts.
Technical details
The vulnerability is a denial-of-service flaw in Boruta's UserSettingsController.update/2 endpoint that atomizes every key from the user-supplied PUT /users/settings request body via String.to_atom/1 before any validation. Because Erlang atoms are interned permanently in the BEAM atom table (default cap 1,048,576), an authenticated user can send requests with fresh keys (e.g., user[fresh_key_N]=value) to exhaust the table. The route is protected only by require_authenticated_user and a per-IP rate limit of 10 req/s; atomization occurs before Ecto/Spark validation, so even failed updates consume atoms. With ~25 bytes per key and a 1MB default Plug body size limit, an attacker can intern ~400,000 atoms per second, exhausting the table in 3–5 seconds. Once exhausted, the BEAM VM aborts with "no more index entries in atom_tab" and crashes the entire Boruta umbrella (auth, admin, gateway, identity apps), persisting until restart. The issue is patched in version 0.10.0.
Affected products
- Boruta Boruta 0.2.0 to 0.9.1
Timeline
- 2026-06-01: disclosed: GHSA advisory published
- 2026-06-12: patched: Version 0.10.0 released with fix
- 2026-09-02: advisory: CVE-2026-49249 published