Description
wger before 2.5 fails to validate the maximum duration of routine date ranges, allowing authenticated users to create routines spanning arbitrarily long periods. Attackers can trigger the date_sequence computation via routine detail endpoints, forcing the server to iterate thousands of times per request and exhaust worker threads, denying service to legitimate users.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| wger-project | wger | < 2.5 | 2.5 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | wger | <= 2.5 | — | GHSA-v25j-wqcw-fvhj |
References
- GitHub Security Advisory (GHSA-v25j-wqcw-fvhj) vendor-advisory
- VulnCheck Advisory: wger before 2.5 Uncontrolled Resource Consumption via date_sequence third-party-advisory