CVE-2026-91968
vikunja before 2.6.0 Denial of Service via unbounded filter recursion
- State
- Published
- Severity
- 7.1 High
- Published
- Sep 15, 2026
- Updated
- Sep 15, 2026
- Reserved
- Sep 15, 2026
Description
vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the task-filter endpoint that accepts deeply nested filter expressions without recursion depth limits. Authenticated attackers can supply thousands of nested parentheses in the filter query parameter to exhaust memory and terminate the API process.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.1 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 6.5 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | VulnCheck |
Weaknesses
- CWE-674 Uncontrolled Recursion
Affected Products
| Product | Versions |
|---|---|
vikunjago-vikunja |
|
References
- GitHub Security Advisory (GHSA-xxc3-xpmc-vmvr)vendor-advisory
- VulnCheck Advisory: vikunja before 2.6.0 Denial of Service via unbounded filter recursionthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.