Vulnerability · Published Nov 8, 2026 · Assigned by VulnCheck
CVE-2026-123501Vikunja before 2.7.1 Memory Exhaustion DoS via Unbounded Image Decodes
Medium 6.5
In plain English
A medium-severity uncontrolled resource consumption in vikunja from go-vikunja. There are no confirmed reports of exploitation so far.
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)–no EPSS score yet
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Vikunja before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated users to exhaust server memory through concurrent image decodes in avatar and background uploads. Attackers can send several parallel tiny, highly compressible PNGs decoded at up to 50 megapixels each, pushing the API process into memory pressure or an OOM kill.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| go-vikunja | vikunja | 0 – before 2.7.1 |
Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
References
- GitHub Security Advisory (GHSA-9hxw-pxcq-4q8q) vendor-advisory
- VulnCheck Advisory: Vikunja before 2.7.1 Memory Exhaustion DoS via Unbounded Image Decodes third-party-advisory