Skip to content
CVE PROGRAM SOURCE RECORD7.1 High

CVE-2026-91968

vikunja before 2.6.0 Denial of Service via unbounded filter recursion

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the task-filter endpoint that accepts deeply nested filter expressions without recursion depth limits. Authenticated attackers can supply thousands of nested parentheses in the filter query parameter to exhaust memory and terminate the API process.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

go-vikunja vikunja

Default version status: unaffected

  • 2.5.0 to < 2.6.0affected
  • 2.6.0unaffected
pkg:golang/code.vikunja.io/api

References