---
id: "CVE-2026-123525"
page: "https://infrastack.ai/live/CVE-2026-123525"
kind: "vulnerability"
aliases: ["CVE-2026-123525"]
title: "Vikunja: migration importers load unlimited data into memory, crashing the API"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["go", "package", "self-hosted", "vikunja"]
not_affected_if: ["auth-required", "managed-hosting"]
published_at: "2026-11-08T02:16:42+00:00"
first_seen_at: "2026-11-08T02:21:09+00:00"
updated_at: "2026-11-08T02:23:26+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123525", "first_seen_at": "2026-11-08T02:21:09+00:00"}]
exploit_sources: []
---

# Vikunja: migration importers load unlimited data into memory, crashing the API

Link for people: https://infrastack.ai/live/CVE-2026-123525 (this .md is for agents)

Vikunja's Trello, Todoist and Microsoft To Do migration importers download attachments and API responses into memory without size limits. An authenticated user can start a migration that exhausts server memory and crashes the API process shared by all users.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Vikunja version with `vikunja version` or the image tag in your deployment; versions before `2.7.1` are affected.
- Confirm whether the Trello, Todoist or Microsoft To Do migration feature is reachable by users on your instance.

## Fix

- Vikunja: move to `2.7.1` or later.

## Timeline

- 2026-11-08T02:21:09+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123525

## Documents

- [advisory] Vendor advisory: github.com https://github.com/go-vikunja/vikunja/security/advisories/GHSA-wqjr-22r7-5437
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/vikunja-before-2.7.1-memory-exhaustion-dos-via-trello-todoist-and-microsoft-to-do-migrations

## From the sources

Vikunja before 2.7.1 allocates memory without limits in its Trello, Todoist and Microsoft To Do migration importers, which buffer remote attachment downloads and API responses in memory without size caps. Authenticated users can start a migration that references huge attacker-served attachments or yields oversized API responses, exhausting memory and crashing the shared API process for all tenants.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_