MEDIUM 5.3 NVD
CVE-2026-123511
Vikunja before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated CalDAV clients to create unbounded dummy tasks by sen
Vikunja before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated CalDAV clients to create unbounded dummy tasks by sending VTODOs with thousands of RELATED-TO properties. Attackers can repeat unknown related UIDs in a single PUT request to generate thousands of task, relation, and event rows, bloating the database and overloading the event pipeline.
References
- https://github.com/go-vikunja/vikunja/security/advisories/GHSA-c934-xjq2-mrg3
- https://www.vulncheck.com/advisories/vikunja-before-2.7.1-resource-exhaustion-via-caldav-v
This medium severity vulnerability with a CVSS score of 5.3 was published on 2026-11-08 via NVD.
vulnfeed aggregates 16937 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.