Description
Vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the Planka migrator that fails to enforce aggregate memory budgets during migration jobs. Authenticated attackers can submit migration requests pointing to attacker-controlled servers advertising numerous size-compliant attachments, exhausting worker memory and causing denial of service for all users.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| go-vikunja | vikunja | < 2.6.0 | 2.6.0 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | code.vikunja.io/api | >= 2.5.0, < 2.6.0 | 2.6.0 | GHSA-wq92-8x3r-fm38 |
| Go | code.vikunja.io/api | all versions | — | GO-2026-6757 |
References
- GitHub Security Advisory (GHSA-wq92-8x3r-fm38) vendor-advisory
- VulnCheck Advisory: Vikunja before 2.6.0 Resource Exhaustion via Planka Migration third-party-advisory