CVE-2026-91969 Details
Description
vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the POST /api/v2/migration/csv/migrate endpoint that fails to limit parsed row cardinality. Authenticated attackers can upload multipart CSV files with millions of tiny records to exhaust process memory and terminate the API service.
A resource exhaustion vulnerability has been identified in Vikunja versions prior to 2.6.0, specifically within the POST /api/v2/migration/csv/migrate endpoint. This vulnerability arises because the endpoint does not limit the number of rows parsed from uploaded multipart CSV files. As a result, authenticated attackers can upload files containing millions of small records, leading to excessive memory consumption and causing the API service to terminate.
To address this vulnerability, it is recommended to enforce proper authorization and implement limits on row cardinality before processing CSV imports. Additionally, releasing partial resources on exit and adding regression tests to prevent future occurrences of this issue would be beneficial.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 15, 2026CISA-ADP
Assessed Sep 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/go-vikunja/vikunja/security/advisories/GHSA-pqf9-h8g4-8gmh | [email protected] | AdvisoryExploitRemedyTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/vikunja-before-2.6.0-resource-exhaustion-via-csv-migration | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| vikunja | >= 2.5.0, < 2.6.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 17, 2026 | CVE Modified | CISA-ADP |
| Sep 15, 2026 | New CVE Received | [email protected] |