CVE-2026-123519 · Package
NO FIX YET · SEE WHAT TO DO
Vikunja before 2.7.1 does not cap the number of items in WeKan or vikunja-file imports. An authenticated user can upload a large WeKan JSON file to the migration endpoint, exhausting server memory and crashing the instance.
first public Oct 22, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams that run a self-hosted Vikunja instance on a version before 2.7.1 and let users import WeKan or vikunja-file data. Instances where only trusted admins can log in, or where the import feature is not used, face less exposure. unknown whether managed hosting differs.
Not affected if version-2.7.1-or-later
Who cares self-hosted, vikunja
2.7.1 boundary.2.7.1 or later.Vikunja before 2.7.1 contains a denial of service vulnerability that allows authenticated users to exhaust API process memory by uploading WeKan or vikunja-file imports with no item-count cap. Attackers can submit a ~22 MB WeKan JSON with hundreds of thousands of cards or duplicate IDs to the wekan migrate endpoint, triggering OOM and crashing the instance.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.