CVE-2026-123523 · Package
NO FIX YET · SEE WHAT TO DO
Vikunja before 2.7.1 caches a separate avatar image for every requested size up to 1024 without eviction. An authenticated user can fill roughly a gigabyte of memory per account, which gets the API process killed by the out-of-memory killer.
first public Oct 22, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Any self-hosted or managed Vikunja instance before 2.7.1 where users can log in and upload an avatar is exposed. Instances where registration and avatar upload are closed to untrusted users carry less risk.
Not affected if no-avatar-upload, version-2.7.1-or-later
Who cares docker, self-hosted, vikunja
vikunja version command or the image tag in your deployment.2.7.1 or later.Vikunja before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated users to exhaust server memory by requesting avatars at many distinct sizes. Attackers can upload a noisy avatar and fetch it at each size up to 1024, caching roughly a gigabyte per account without eviction and causing the API process to be OOM-killed.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.