HIGH 7.1 NVD
CVE-2026-91968
vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the task-filter endpoint that accepts deeply nested filter expressions without recu
vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the task-filter endpoint that accepts deeply nested filter expressions without recursion depth limits. Authenticated attackers can supply thousands of nested parentheses in the filter query parameter to exhaust memory and terminate the API process.
References
- https://github.com/go-vikunja/vikunja/security/advisories/GHSA-xxc3-xpmc-vmvr
- https://www.vulncheck.com/advisories/vikunja-before-2.6.0-denial-of-service-via-unbounded-
- https://github.com/go-vikunja/vikunja/security/advisories/GHSA-xxc3-xpmc-vmvr
This high severity vulnerability with a CVSS score of 7.1 was published on 2026-09-15 via NVD.
vulnfeed aggregates 13549 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.