CVE-2026-86255 in wger
Summary
by MITRE • 09/06/2026
wger before 2.5 fails to validate the maximum duration of routine date ranges, allowing authenticated users to create routines spanning arbitrarily long periods. Attackers can trigger the date_sequence computation via routine detail endpoints, forcing the server to iterate thousands of times per request and exhaust worker threads, denying service to legitimate users.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/06/2026
The vulnerability in wger versions prior to 2.5 represents a significant flaw in input validation logic concerning temporal data boundaries for user-defined routines. Specifically, the application fails to enforce an upper limit on the duration of date ranges associated with fitness or exercise routines. This oversight allows authenticated users to define start and end dates that span excessively long periods without triggering any server-side rejection or warning mechanisms. The core technical issue lies in the absence of a hard constraint on the delta between the initial and final dates within routine creation endpoints, which permits the submission of payloads containing date sequences with thousands or even millions of days difference.
This lack of validation directly impacts system stability by enabling a resource exhaustion attack vector. When an authenticated user submits such a malformed request through routine detail endpoints, the server is compelled to process the extensive date sequence internally. The application logic iterates through each day in the specified range to perform necessary computations or database operations related to the routine's schedule. This iterative processing consumes substantial CPU cycles and memory resources proportional to the length of the date range. Consequently, an attacker can deliberately trigger this computation with extreme values, forcing the server to execute thousands of iterations per single request.
The operational impact of this vulnerability is primarily a denial of service condition for legitimate users. By exhausting available worker threads or processing capacity on the backend servers, malicious actors can effectively block access to the application for other users. This type of attack exploits the asymmetry between the low cost of sending a small HTTP request and the high computational cost required by the server to process it. The resulting resource contention degrades performance across the entire system, potentially leading to complete service unavailability until the affected threads are cleared or the server is restarted.
From a classification perspective, this vulnerability aligns with CWE-20 Improper Input Validation, as the application fails to verify that user-supplied data falls within expected bounds before processing it. It also relates to CWE-787 Out-of-bounds Write if the iteration leads to memory corruption in lower-level components, though primarily it manifests as a resource exhaustion issue consistent with CWE-400 Uncontrolled Resource Consumption. In terms of offensive security frameworks, this behavior is characteristic of ATT&CK technique T1496 Resource Hijacking, where an attacker consumes system resources to degrade service availability for legitimate users.
Mitigation strategies must focus on implementing strict input validation at the application layer immediately upon receipt of routine data. Developers should define and enforce a maximum allowable duration for date ranges in routines, such as limiting spans to no more than one or two years depending on business requirements. Additionally, introducing rate limiting on endpoints that perform heavy iterative computations can help mitigate the impact of malicious requests by throttling excessive usage from single sources. Upgrading to wger version 2.5 or later is essential, as these versions include patches for this specific validation flaw. Security teams should also monitor server logs for unusual spikes in CPU utilization associated with routine creation endpoints to detect potential exploitation attempts in real time.