CVE-2026-91970
Vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the Planka migrator that fails to enforce aggregate memory budgets during migration jobs. Authenticated attackers can submit migration requests pointing to attacker-controlled servers advertising numerous size-compliant attachments, exhausting worker memory and causing denial of service for all users.
Scoring
- Severity
- HIGH
- CVSS base score
- 7.1
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- EPSS probability
- 0.37%
- CWE
- CWE-770
- Published
- 2026-09-15
- Last modified
- 2026-09-15
Affected products
- go-vikunja vikunja
- go-vikunja vikunja
Weakness type
Related vulnerabilities
- CVE-2026-1168 — Allocation of Resources Without Limits or Throttling in GitLab
- CVE-2025-14871 — Allocation of Resources Without Limits or Throttling in GitLab
- CVE-2026-88878 — Traefik v2.8.2 through v3.6 HTTP/3 Timeout Bypass
- CVE-2026-82439 — Apache Storm DRPC: Unauthenticated Unbounded Memory Growth in DRPC
- CVE-2026-72684 — Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service
- CVE-2026-74878 — openssl_encrypt before 1.4.0 TOTP Rate Limiter Bypass
- CVE-2026-77337 — CakePHP: Potential Authentication bypass with CookieAuthenticator
- CVE-2026-79921 — amqp091-go has a Potential Memory Exhaustion/Protocol Violation via Broker-Controlled Oversized Payload