---
id: "CVE-2026-123501"
page: "https://infrastack.ai/live/CVE-2026-123501"
kind: "vulnerability"
aliases: ["CVE-2026-123501"]
title: "Vikunja: parallel image uploads can exhaust server memory and crash it"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["go", "package", "self-hosted", "vikunja"]
not_affected_if: ["auth-required", "managed-hosting", "uploads-disabled"]
published_at: "2026-11-08T02:16:37+00:00"
first_seen_at: "2026-11-08T02:21:08+00:00"
updated_at: "2026-11-08T02:24:35+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123501", "first_seen_at": "2026-11-08T02:21:08+00:00"}]
exploit_sources: []
---

# Vikunja: parallel image uploads can exhaust server memory and crash it

Link for people: https://infrastack.ai/live/CVE-2026-123501 (this .md is for agents)

Vikunja is a self-hosted task manager. Logged-in users can send many small, highly compressed PNG files at once for avatar or background uploads, forcing the server to decode very large images and run out of memory.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Vikunja version (for example `vikunja version` or the image tag in your deployment) and see whether it is below `2.7.1`.
- Check whether user accounts can upload avatars or background images on your instance.

## Fix

- Upgrade Vikunja to `2.7.1` or later.

## Timeline

- 2026-11-08T02:21:08+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123501

## Documents

- [advisory] Vendor advisory: github.com https://github.com/go-vikunja/vikunja/security/advisories/GHSA-9hxw-pxcq-4q8q
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/vikunja-before-2.7.1-memory-exhaustion-dos-via-unbounded-image-decodes

## From the sources

Vikunja before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated users to exhaust server memory through concurrent image decodes in avatar and background uploads. Attackers can send several parallel tiny, highly compressible PNGs decoded at up to 50 megapixels each, pushing the API process into memory pressure or an OOM kill.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_