Uncontrolled Resource Consumption Vulnerability in Vikunja by Vikunja Inc.

CVE-2026-123523

What is CVE-2026-123523?

Vikunja versions prior to 2.7.1 have a vulnerability that allows authenticated users to exploit an uncontrolled resource consumption flaw. By requesting avatars in multiple distinct sizes, attackers can saturate server memory. This can lead to an accumulation of cached data, potentially reaching around a gigabyte per account due to fetching these large avatars, without any eviction mechanism in place. Consequently, the API process may suffer from out-of-memory errors, potentially affecting overall system performance and stability.

References