CVE-2026-91969

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-91969

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-91969.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-91969

Aliases

GHSA-pqf9-h8g4-8gmh

Published

2026-09-15T15:18:20Z

Modified

2026-09-19T03:30:26Z

Severity

7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

vikunja before 2.6.0 Resource Exhaustion via CSV Migration

Details

vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the POST /api/v2/migration/csv/migrate endpoint that fails to limit parsed row cardinality. Authenticated attackers can upload multipart CSV files with millions of tiny records to exhaust process memory and terminate the API service.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-400"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91969.json"
}

References

Affected packages

Git / github.com/go-vikunja/vikunja

Affected ranges

Type

GIT

Repo

https://github.com/go-vikunja/vikunja

Events

Introduced

ef2200e9429c5cc42f5c1811433418bfcc72b3aa

Fixed

a4218eeb8fb3ada95e14a2331731524c9120d5bd

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "2.5.0"
        },
        {
            "fixed":  "2.6.0"
        },
        {
            "introduced":  "0"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

v2.*

v2.5.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-91969.json"