HIGH 7.1 NVD
CVE-2026-123525
Vikunja before 2.7.1 allocates memory without limits in its Trello, Todoist and Microsoft To Do migration importers, which buffer remote attachment downloads an
Vikunja before 2.7.1 allocates memory without limits in its Trello, Todoist and Microsoft To Do migration importers, which buffer remote attachment downloads and API responses in memory without size caps. Authenticated users can start a migration that references huge attacker-served attachments or yields oversized API responses, exhausting memory and crashing the shared API process for all tenants.
References
- https://github.com/go-vikunja/vikunja/security/advisories/GHSA-wqjr-22r7-5437
- https://www.vulncheck.com/advisories/vikunja-before-2.7.1-memory-exhaustion-dos-via-trello
This high severity vulnerability with a CVSS score of 7.1 was published on 2026-11-08 via NVD.
vulnfeed aggregates 16937 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.