CVE-2026-91968
vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the task-filter endpoint that accepts deeply nested filter expressions without recursion depth limits. Authenticated attackers can supply thousands of nested parentheses in the filter query parameter to exhaust memory and terminate the API process.
Scoring
- Severity
- HIGH
- CVSS base score
- 7.1
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- EPSS probability
- 0.37%
- CWE
- CWE-674
- Published
- 2026-09-15
- Last modified
- 2026-09-15
Affected products
- go-vikunja vikunja
- go-vikunja vikunja
Weakness type
Related vulnerabilities
- CVE-2026-33498 — Parse Server: Query condition depth bypass via pre-validation transform pipeline
- CVE-2026-32944 — Parse Server crash via deeply nested query condition operators
- CVE-2025-66031 — node-forge ASN.1 Unbounded Recursion
- CVE-2026-33508 — Parse Server: LiveQuery subscription query depth bypass
- CVE-2026-72686 — Uncontrolled Recursion in Elasticsearch Leading to Denial of Service
- CVE-2026-72679 — Uncontrolled Recursion in Elasticsearch Leading to Denial of Service
- CVE-2026-72647 — Uncontrolled Recursion in Elasticsearch Leading to Denial of Service
- CVE-2026-72638 — Uncontrolled Recursion in Elasticsearch Leading to Denial of Service