Live › vulnerability › CVE-2026-91968
Go to dashboardVikunja's Go API package accepts nested task filters with no depth limit, so recursion can exhaust the stack. An attacker who can send a crafted filter query can crash the API process.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| code.vikunja.io/api | go | all versions | – |
Check whether the Go module code.vikunja.io/api is in your go.mod at a version below v2.6.0 (for example: grep code.vikunja.io/api go.mod).
v2.6.0 or laterv2.6.0, with the v2.5.0 to v2.6.0 range listed explicitlyEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vikunja: Unbounded nested task-filter recursion permits API process termination in code.vikunja.io/api.
NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.
(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)
The additional affected modules and versions are: code.vikunja.io/api from v2.5.0 before v2.6.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-91968")
Go Vulnerability Database, CC-BY 4.0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.