Boruta, an OAuth 2.0 and OpenID Connect authorization server, contains a flaw in the UserSettingsController.update/2 endpoint. The endpoint converts every key in the user‑supplied request body into an atom unconditionally. Because atoms are permanently stored in the BEAM atom table, an attacker can repeatedly send requests with unique keys, rapidly exhausting the table. Once full, the BEAM process aborts, bringing down the entire OIDC server and its associated applications. This results in a denial of service.

The vulnerability affects malach‑it Boruta‑Server releases prior to version 0.10.0. Any authenticated user of the server can trigger the flaw by issuing a PUT /users/settings request with a uniquely keyed payload. The issue was resolved in version 0.10.0 by removing the unconditional atomization step.

The CVSS v3.1 base score is 7.1, indicating a high severity. No EPSS score is available and the flaw is not listed in the CISA KEV catalog, but the attack requires only authentication to the server, which a normal user possesses. A per‑IP rate limit of 10 requests per second offers minimal protection, and repeated use will quickly saturate the atom table. The resulting crash affects all components of the umbrella application, making this a high‑risk denial‑of‑service vector for any organization running an affected Boruta server.