Resource Exhaustion Vulnerability in Vikunja by Vikunja Team
CVE-2026-123516

7.1HIGH

Key Information:

Vendor

Go-vikunja

Status
Vikunja
Vendor
CVE Published:
8 November 2026

What is CVE-2026-123516?

Prior to version 2.7.1, Vikunja contains a resource exhaustion vulnerability in its ZIP importer. This issue allows authenticated users to upload ZIP files with a large number of entries, leading to excessive consumption of CPU and memory resources. Attackers may exploit this flaw by submitting export ZIPs filled with numerous empty or invalid file entries, evading the limitations in place. As a result, the 'scanArchive' function will unnecessarily process each entry multiple times, potentially degrading system performance and availability.

Affected Version(s)

vikunja 0 < 2.7.1

vikunja 2.7.1

References

https://github.com/go-vikunja/vikunja/security/advisories...
vendor-advisory
https://www.vulncheck.com/advisories/vikunja-before-2.7.1...
third-party-advisory

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.