Resource Exhaustion Vulnerability in Vikunja by Vikunja

CVE-2026-91968

What is CVE-2026-91968?

Vikunja versions prior to 2.6.0 are susceptible to a resource exhaustion vulnerability within the task-filter endpoint. The issue arises from the lack of recursion depth limits when processing filter expressions. This allows authenticated attackers to exploit the API by sending overly complex nested filter queries, containing thousands of nested parentheses. As a result, the excessive memory consumption can lead to service disruption and potential termination of the API process, posing a significant threat to the application's availability.

References