{"id":"CVE-2026-123501","kind":"vulnerability","aliases":["CVE-2026-123501"],"related":[],"title":"Vikunja: parallel image uploads can exhaust server memory and crash it","description":"Vikunja before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated users to exhaust server memory through concurrent image decodes in avatar and background uploads. Attackers can send several parallel tiny, highly compressible PNGs decoded at up to 50 megapixels each, pushing the API process into memory pressure or an OOM kill.","summary":"Vikunja is a self-hosted task manager. Logged-in users can send many small, highly compressed PNG files at once for avatar or background uploads, forcing the server to decode very large images and run out of memory.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["go","package","self-hosted","vikunja"],"not_affected_if":["auth-required","managed-hosting","uploads-disabled"],"how_to_check":"- Check the installed Vikunja version (for example `vikunja version` or the image tag in your deployment) and see whether it is below `2.7.1`.\n- Check whether user accounts can upload avatars or background images on your instance.","fix":"- Upgrade Vikunja to `2.7.1` or later.","status":"open","published_at":"2026-11-08T02:16:37+00:00","first_seen_at":"2026-11-08T02:21:08+00:00","triaged_at":"2026-11-08T02:24:35+00:00","updated_at":"2026-11-08T02:24:35+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-08T02:24:35Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Vikunja to `2.7.1` or later.","reach":"network","title":"Vikunja: parallel image uploads can exhaust server memory and crash it","impact":"medium","summary":"Vikunja is a self-hosted task manager. Logged-in users can send many small, highly compressed PNG files at once for avatar or background uploads, forcing the server to decode very large images and run out of memory.","audience":"businesses","category":"package","nicknames":[],"who_cares":["vikunja","self-hosted","go"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"API process runs out of memory and gets killed, causing denial of service","analyst_note":"","how_to_check":"- Check the installed Vikunja version (for example `vikunja version` or the image tag in your deployment) and see whether it is below `2.7.1`.\n- Check whether user accounts can upload avatars or background images on your instance.","plain_action":"","needs_analyst":false,"not_affected_if":["managed-hosting","auth-required","uploads-disabled"],"who_is_affected":"Teams that run a self-hosted Vikunja instance older than 2.7.1 where users can log in and upload avatars or background images. Hosted or unauthenticated-only deployments are less exposed, since the attacker needs an account.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000675,"input_tokens":4293,"output_tokens":491,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123501':13A,16A '-2026':12A,15A '2.7.1':65C '50':102C 'allow':73C 'api':107C 'attack':89C 'authent':74C 'avatar':46B,85C 'background':48B,87C 'compress':40B,96C 'concurr':81C 'consumpt':70C 'contain':66C 'crash':10A 'cve':11A,14A 'decod':54B,83C,98C 'exhaust':6A,77C 'file':42B 'forc':50B 'go':17B 'high':39B,95C 'host':21B,28B 'imag':3A,57B,82C 'kill':115C 'larg':56B 'log':32B 'logged-in':31B 'manag':30B 'mani':37B 'megapixel':103C 'memori':8A,62B,79C,110C 'oom':114C 'packag':18B 'parallel':2A,93C 'png':41B 'pngs':97C 'pressur':111C 'process':108C 'push':105C 'resourc':69C 'run':59B 'self':20B,27B 'self-host':19B,26B 'send':36B,91C 'server':7A,52B,78C 'sever':92C 'small':38B 'task':29B 'tini':94C 'uncontrol':68C 'upload':4A,49B,88C 'user':34B,75C 'vikunja':1A,22B,23B,63C 'vulner':71C","nicknames":[],"mitigations":[],"who_affected":"Teams that run a self-hosted Vikunja instance older than 2.7.1 where users can log in and upload avatars or background images. Hosted or unauthenticated-only deployments are less exposed, since the attacker needs an account.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["go","high","package","selfhosted","vikunja"],"campaign_type":null,"search_a":"'-123501':13A,16A '-2026':12A,15A 'crash':10A 'cve':11A,14A 'exhaust':6A 'imag':3A 'memori':8A 'parallel':2A 'server':7A 'upload':4A 'vikunja':1A","search_b":"'avatar':46B 'background':48B 'compress':40B 'decod':54B 'file':42B 'forc':50B 'go':17B 'high':39B 'host':21B,28B 'imag':57B 'larg':56B 'log':32B 'logged-in':31B 'manag':30B 'mani':37B 'memori':62B 'packag':18B 'png':41B 'run':59B 'self':20B,27B 'self-host':19B,26B 'send':36B 'server':52B 'small':38B 'task':29B 'upload':49B 'user':34B 'vikunja':22B,23B","search_c":"'2.7.1':65C '50':102C 'allow':73C 'api':107C 'attack':89C 'authent':74C 'avatar':85C 'background':87C 'compress':96C 'concurr':81C 'consumpt':70C 'contain':66C 'decod':83C,98C 'exhaust':77C 'high':95C 'imag':82C 'kill':115C 'megapixel':103C 'memori':79C,110C 'oom':114C 'parallel':93C 'pngs':97C 'pressur':111C 'process':108C 'push':105C 'resourc':69C 'send':91C 'server':78C 'sever':92C 'tini':94C 'uncontrol':68C 'upload':88C 'user':75C 'vikunja':63C 'vulner':71C","first_public_at":"2026-10-22T10:01:14+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123501","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123501","severity":null,"published_at":"2026-11-08T02:16:37+00:00","modified_at":"2026-11-08T02:16:37+00:00","first_seen_at":"2026-11-08T02:21:08+00:00","fetched_at":"2026-11-08T02:21:08+00:00","note":null}],"documents":[{"id":99151,"url":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-9hxw-pxcq-4q8q","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-22T10:01:14+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":99152,"url":"https://www.vulncheck.com/advisories/vikunja-before-2.7.1-memory-exhaustion-dos-via-unbounded-image-decodes","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}