{"id":"CVE-2026-123523","kind":"vulnerability","aliases":["CVE-2026-123523"],"related":[],"title":"Vikunja: avatar size requests exhaust server memory, crashing the API","description":"Vikunja before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated users to exhaust server memory by requesting avatars at many distinct sizes. Attackers can upload a noisy avatar and fetch it at each size up to 1024, caching roughly a gigabyte per account without eviction and causing the API process to be OOM-killed.","summary":"Vikunja before 2.7.1 caches a separate avatar image for every requested size up to 1024 without eviction. An authenticated user can fill roughly a gigabyte of memory per account, which gets the API process killed by the out-of-memory killer.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["docker","package","self-hosted","vikunja"],"not_affected_if":["no-avatar-upload","version-2.7.1-or-later"],"how_to_check":"- Check the Vikunja version the API runs, for example with the `vikunja version` command or the image tag in your deployment.\n- Confirm whether users can upload avatars in your instance's settings.","fix":"- Vikunja: move to `2.7.1` or later.","status":"open","published_at":"2026-11-08T02:16:41+00:00","first_seen_at":"2026-11-08T02:21:09+00:00","triaged_at":"2026-11-08T02:23:27+00:00","updated_at":"2026-11-08T02:23:27+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-08T02:23:27Z","model":"claude-haiku-5-5","output":{"fix":"- Vikunja: move to `2.7.1` or later.","reach":"network","title":"Vikunja: avatar size requests exhaust server memory, crashing the API","impact":"low","summary":"Vikunja before 2.7.1 caches a separate avatar image for every requested size up to 1024 without eviction. An authenticated user can fill roughly a gigabyte of memory per account, which gets the API process killed by the out-of-memory killer.","audience":"businesses","category":"package","nicknames":[],"who_cares":["vikunja","self-hosted","docker"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"API process crashes from memory exhaustion, causing denial of service","analyst_note":"","how_to_check":"- Check the Vikunja version the API runs, for example with the `vikunja version` command or the image tag in your deployment.\n- Confirm whether users can upload avatars in your instance's settings.","plain_action":"","needs_analyst":false,"not_affected_if":["version-2.7.1-or-later","no-avatar-upload"],"who_is_affected":"Any self-hosted or managed Vikunja instance before 2.7.1 where users can log in and upload an avatar is exposed. Instances where registration and avatar upload are closed to untrusted users carry less risk.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000674,"input_tokens":4292,"output_tokens":490,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123523':13A,16A '-2026':12A,15A '1024':37B,103C '2.7.1':25B,67C 'account':51B,109C 'allow':75C 'api':10A,55B,115C 'attack':89C 'authent':41B,76C 'avatar':2A,29B,84C,94C 'cach':26B,104C 'caus':113C 'consumpt':72C 'contain':68C 'crash':8A 'cve':11A,14A 'distinct':87C 'docker':17B 'everi':32B 'evict':39B,111C 'exhaust':5A,79C 'fetch':96C 'fill':44B 'get':53B 'gigabyt':47B,107C 'host':21B 'imag':30B 'kill':57B,121C 'killer':64B 'mani':86C 'memori':7A,49B,63B,81C 'noisi':93C 'oom':120C 'oom-kil':119C 'out-of-memori':60B 'packag':18B 'per':50B,108C 'process':56B,116C 'request':4A,33B,83C 'resourc':71C 'rough':45B,105C 'self':20B 'self-host':19B 'separ':28B 'server':6A,80C 'size':3A,34B,88C,100C 'uncontrol':70C 'upload':91C 'user':42B,77C 'vikunja':1A,22B,23B,65C 'vulner':73C 'without':38B,110C","nicknames":[],"mitigations":[],"who_affected":"Any self-hosted or managed Vikunja instance before 2.7.1 where users can log in and upload an avatar is exposed. Instances where registration and avatar upload are closed to untrusted users carry less risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["docker","high","package","selfhosted","vikunja"],"campaign_type":null,"search_a":"'-123523':13A,16A '-2026':12A,15A 'api':10A 'avatar':2A 'crash':8A 'cve':11A,14A 'exhaust':5A 'memori':7A 'request':4A 'server':6A 'size':3A 'vikunja':1A","search_b":"'1024':37B '2.7.1':25B 'account':51B 'api':55B 'authent':41B 'avatar':29B 'cach':26B 'docker':17B 'everi':32B 'evict':39B 'fill':44B 'get':53B 'gigabyt':47B 'host':21B 'imag':30B 'kill':57B 'killer':64B 'memori':49B,63B 'out-of-memori':60B 'packag':18B 'per':50B 'process':56B 'request':33B 'rough':45B 'self':20B 'self-host':19B 'separ':28B 'size':34B 'user':42B 'vikunja':22B,23B 'without':38B","search_c":"'1024':103C '2.7.1':67C 'account':109C 'allow':75C 'api':115C 'attack':89C 'authent':76C 'avatar':84C,94C 'cach':104C 'caus':113C 'consumpt':72C 'contain':68C 'distinct':87C 'evict':111C 'exhaust':79C 'fetch':96C 'gigabyt':107C 'kill':121C 'mani':86C 'memori':81C 'noisi':93C 'oom':120C 'oom-kil':119C 'per':108C 'process':116C 'request':83C 'resourc':71C 'rough':105C 'server':80C 'size':88C,100C 'uncontrol':70C 'upload':91C 'user':77C 'vikunja':65C 'vulner':73C 'without':110C","first_public_at":"2026-10-22T10:07:13+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123523","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123523","severity":null,"published_at":"2026-11-08T02:16:41+00:00","modified_at":"2026-11-08T02:16:41+00:00","first_seen_at":"2026-11-08T02:21:09+00:00","fetched_at":"2026-11-08T02:21:09+00:00","note":null}],"documents":[{"id":99195,"url":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-3x3m-2j93-w46j","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-22T10:07:13+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":99196,"url":"https://www.vulncheck.com/advisories/vikunja-before-2.7.1-memory-exhaustion-via-unbounded-avatar-size-cache","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}