CVE-2026-91968

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-91968

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-91968.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-91968

Aliases

GHSA-xxc3-xpmc-vmvr

Published

2026-09-15T15:18:20Z

Modified

2026-09-17T03:47:22Z

Severity

7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

vikunja before 2.6.0 Denial of Service via unbounded filter recursion

Details

vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the task-filter endpoint that accepts deeply nested filter expressions without recursion depth limits. Authenticated attackers can supply thousands of nested parentheses in the filter query parameter to exhaust memory and terminate the API process.

Database specific

{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-674"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91968.json"
}

References

Affected packages

Git / github.com/go-vikunja/vikunja

Affected ranges

Type

GIT

Repo

https://github.com/go-vikunja/vikunja

Events

Introduced

ef2200e9429c5cc42f5c1811433418bfcc72b3aa

Fixed

a4218eeb8fb3ada95e14a2331731524c9120d5bd

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "2.5.0"
        },
        {
            "fixed": "2.6.0"
        },
        {
            "introduced": "0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

v2.*

v2.5.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-91968.json"