{"id":"CVE-2026-91979","kind":"vulnerability","aliases":["CVE-2026-91979","GHSA-w7jp-mf2v-8342","GO-2026-6756"],"related":[],"title":"Vikunja: Denial of service via decompression bomb in the data import in code.vikunja.io/api","description":"Vikunja: Denial of service via decompression bomb in the data import in code.vikunja.io/api.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: code.vikunja.io/api before v2.6.0.","summary":"Vikunja's Go API module (code.vikunja.io/api) can be crashed by a decompression bomb, a small compressed file that expands to a huge size, during data import. An attacker who can submit an import gets denial of service, meaning the server stops responding.","severity":"high","cvss":7.1,"epss":0.00436,"exploited":false,"exploited_at":null,"products":[{"name":"code.vikunja.io/api","fixed":[],"affected":"all versions","ecosystem":"go"}],"ecosystems":["go"],"tags":["go","package","self-hosted","vikunja"],"not_affected_if":["no-data-import-exposed","version-2.6.0-or-later"],"how_to_check":"Check the version of code.vikunja.io/api in go.mod or the running Vikunja binary; versions before v2.6.0 are affected.","fix":"Upgrade code.vikunja.io/api to v2.6.0 or later and rebuild or redeploy Vikunja.","status":"open","published_at":"2026-09-15T16:17:54+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T21:45:46+00:00","updated_at":"2026-10-23T21:45:46+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T21:45:46Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade code.vikunja.io/api to v2.6.0 or later and rebuild or redeploy Vikunja.\nunknown","reach":"unknown","impact":"low","summary":"Vikunja's Go API module (code.vikunja.io/api) can be crashed by a decompression bomb, a small compressed file that expands to a huge size, during data import. An attacker who can submit an import gets denial of service, meaning the server stops responding.","category":"package","who_cares":["vikunja","self-hosted","go"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Server becomes unresponsive from memory or CPU exhaustion during import.","analyst_note":"Confirm whether import requires a logged-in user and which import formats are affected; check the GHSA-w7jp-mf2v-8342 advisory at pkg.go.dev/vuln/GO-2026-6756.","how_to_check":"Check the version of code.vikunja.io/api in go.mod or the running Vikunja binary; versions before v2.6.0 are affected.\nunknown","needs_analyst":true,"not_affected_if":["version-2.6.0-or-later","no-data-import-exposed"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000517,"input_tokens":2941,"output_tokens":446,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':17A,25A,28A '-6756':26A '-91979':18A,29A '/api':15A,32A,146C '/api)':46B '/api.':97C '8342':23A 'addit':106C,138C 'advisori':101C 'affect':139C 'api':42B 'attack':68B 'automat':112C 'bomb':7A,53B,89C 'caus':122C 'code.vikunja.io':14A,31A,45B,96C,145C 'code.vikunja.io/api':13A,30A,144C 'code.vikunja.io/api)':44B 'code.vikunja.io/api.':95C 'compress':56B 'contain':105C 'could':109C 'crash':49B 'cve':16A,27A 'data':10A,65B,92C 'decompress':6A,52B,88C 'denial':2A,75B,84C 'edit':133C 'expand':59B 'fals':124C 'false-posit':123C 'file':57B 'get':74B 'ghsa':20A 'ghsa-w7jp-mf2v':19A 'go':24A,33B,41B,116C 'host':37B 'huge':62B 'import':11A,66B,73B,93C 'map':113C 'mean':78B 'mf2v':22A 'modul':43B,117C,140C 'note':98C 'packag':34B 'pleas':130C 'posit':125C 'report':104C,126C,136C 'respond':82B 'scanner':129C 'self':36B 'self-host':35B 'server':80B 'servic':4A,77B,86C 'size':63B 'small':55B 'sourc':100C 'standard':115C 'stop':81B 'submit':71B 'suggest':131C 'v2.6.0':148C 'version':107C,118C,142C 'via':5A,87C 'vikunja':1A,38B,39B,83C 'vulner':128C 'w7jp':21A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-15T16:17:54+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6756","url":"https://pkg.go.dev/vuln/GO-2026-6756","severity":null,"published_at":"2026-10-19T21:08:26+00:00","modified_at":"2026-10-19T21:08:26+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-91979","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91979","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-91979","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91979","severity":null,"published_at":"2026-09-15T16:17:54+00:00","modified_at":"2026-09-17T20:18:54+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}