Live › vulnerability › CVE-2026-91970
Go to dashboardThe Vikunja API's Planka migration keeps an unbounded collection of attachments served by a remote source. An attacker who controls that source can exhaust the API's memory and crash it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| code.vikunja.io/api | go | all versions | – |
Check go.mod for code.vikunja.io/api; versions from v2.5.0 before v2.6.0 are affected.
Upgrade code.vikunja.io/api to v2.6.0 or later.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vikunja: Planka migration retains an unbounded aggregate of attacker-served attachments and can OOM the API in code.vikunja.io/api.
NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.
(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)
The additional affected modules and versions are: code.vikunja.io/api from v2.5.0 before v2.6.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-91970")
Go Vulnerability Database, CC-BY 4.0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.