Live › vulnerability › CVE-2026-91979
Go to dashboardVikunja's Go API module (code.vikunja.io/api) can be crashed by a decompression bomb, a small compressed file that expands to a huge size, during data import. An attacker who can submit an import gets denial of service, meaning the server stops responding.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| code.vikunja.io/api | go | all versions | – |
Check the version of code.vikunja.io/api in go.mod or the running Vikunja binary; versions before v2.6.0 are affected.
Upgrade code.vikunja.io/api to v2.6.0 or later and rebuild or redeploy Vikunja.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vikunja: Denial of service via decompression bomb in the data import in code.vikunja.io/api.
NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.
(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)
The additional affected modules and versions are: code.vikunja.io/api before v2.6.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-91979")
Go Vulnerability Database, CC-BY 4.0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.