Live › vulnerability › CVE-2026-91969
Go to dashboardVikunja's authenticated CSV migration endpoint (POST /api/v2/migration/csv/migrate) caps upload bytes but not row count. It parses every row into memory and builds a task object for each. About 2 million one-cell rows (a ~4 MB request) got a 512 MiB API process OOM-killed. Any logged-in user, including a self-registered one if registration is open, can take the API down for everyone. VulnCheck rates it CVSS v4 7.1.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| code.vikunja.io/api | go | all versions | – |
| code.vikunja.io/api | go | >= 2.5.0, < 2.6.0 | 2.6.0 |
vikunja version, or check the Docker image tag or the /api/v1/info version field2.5.0 and < 2.6.0 are affected2.5.0 were not established as affectedv2.6.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vikunja: Unbounded CSV row cardinality permits API process termination in code.vikunja.io/api.
NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.
(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)
The additional affected modules and versions are: code.vikunja.io/api from v2.5.0 before v2.6.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-91969")
Go Vulnerability Database, CC-BY 4.0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.