cyfenced.com →

[ CVE-2026-91969 · Published 15 Sep 2026 ]

Vikunja: Unbounded CSV row cardinality permits API process termination

CVSS 6.5 EPSS <1%Fix available

[ Description ]Official description

vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the POST /api/v2/migration/csv/migrate endpoint that fails to limit parsed row cardinality. Authenticated attackers can upload multipart CSV files with millions of tiny records to exhaust process memory and terminate the API service.

[ Fixes ]Fixes and patches

  • code.vikunja.io/api 2.6.0Fixed version · GitHub Advisories · go package code.vikunja.io/api: upgrade to 2.6.0 or later (affected = 2.5.0)

[ Packages ]Affected open-source packages

[ References ]References