CVE-2026-91969

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-91969
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-91969.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-91969
Aliases
Published
2026-09-15T15:18:20Z
Modified
2026-10-22T10:35:05Z
Severity
  • 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
vikunja before 2.6.0 Resource Exhaustion via CSV Migration
Details

vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the POST /api/v2/migration/csv/migrate endpoint that fails to limit parsed row cardinality. Authenticated attackers can upload multipart CSV files with millions of tiny records to exhaust process memory and terminate the API service.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-400"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91969.json"
}
References

Affected packages

Git / github.com/go-vikunja/vikunja

Affected ranges

Type
GIT
Repo
https://github.com/go-vikunja/vikunja
Events
Introduced
ef2200e9429c5cc42f5c1811433418bfcc72b3aa
Fixed
a4218eeb8fb3ada95e14a2331731524c9120d5bd
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "2.5.0"
                },
                {
                    "fixed": "2.6.0"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "2.6.0"
                }
            ],
            "source": "DESCRIPTION"
        }
    ]
}

Affected versions

v2.*
v2.5.0

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-91969.json"