CVE-2026-49249

Name of the Vulnerable Software and Affected Versions Boruta versions prior to 0.10.0

Description An authenticated user can cause a denial of service by sending requests to the 'PUT /users/settings' endpoint. The application uses the String.to atom/1 function to process keys in the request body before validation. Because this function interns atoms permanently in the BEAM atom table, an attacker can provide unique keys in the user parameter to exhaust the global VM atom table. Once the table reaches its capacity, the BEAM virtual machine aborts, causing the entire OIDC server to crash. This process occurs before the Accounts.update user/6 function is called, meaning even invalid updates can lead to resource exhaustion.

Recommendations Update to version 0.10.0.