CVE-2026-91968 in vikunja
Summary
by MITRE • 09/15/2026
vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the task-filter endpoint that accepts deeply nested filter expressions without recursion depth limits. Authenticated attackers can supply thousands of nested parentheses in the filter query parameter to exhaust memory and terminate the API process.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/15/2026
The vulnerability identified in Vikunja versions prior to 2.6.0 represents a critical resource exhaustion flaw located within the task-filter endpoint, which is designed to allow users to retrieve specific tasks based on complex filtering criteria. This component accepts filter expressions that can include nested logical conditions and parentheses to define intricate query structures. However, the underlying implementation fails to enforce any recursion depth limits or maximum complexity constraints on these input strings. As a result, an authenticated attacker can craft maliciously constructed HTTP requests containing thousands of deeply nested parentheses within the filter query parameter. This lack of validation allows the application's parser to enter into excessive recursive processing loops, consuming system memory at an unsustainable rate until the server process is forced to terminate due to resource exhaustion.
From a technical perspective, this flaw aligns with CWE-787 Out-of-bounds Write and more specifically CWE-400 Uncontrolled Resource Consumption, as the application does not properly limit the allocation of resources based on user input. The absence of recursion depth checks means that the server's call stack grows indefinitely until it exceeds available memory or hits operating system limits for thread stacks. This behavior is characteristic of improper input validation where the complexity of the data structure is left unchecked against predefined thresholds. In terms of attack classification, this vulnerability maps to MITRE ATT&CK technique T1496 Resource Hijacking, specifically under the sub-technique of Denial of Service via resource exhaustion. The attacker leverages their authenticated status to bypass initial access controls and directly targets the application's stability rather than attempting to exfiltrate data or gain unauthorized privilege escalation.
The operational impact of this vulnerability is severe for any deployment relying on Vikunja as a mission-critical task management service. By triggering memory exhaustion, an attacker can cause a denial-of-service condition that renders the API unresponsive to legitimate users. This disruption affects not only the availability of the specific endpoint but potentially the entire application instance if the process crashes and requires manual restart or fails to recover automatically. For organizations using Vikunja in production environments, this vulnerability poses a significant risk to business continuity, as repeated attacks could lead to frequent service outages requiring administrative intervention. Furthermore, the ease with which such an attack can be executed means that even low-skilled attackers armed with automated tools could disrupt services without needing sophisticated exploitation techniques beyond crafting specific HTTP payloads.
Mitigation strategies must focus on immediate patching and defensive configuration changes. The primary remediation is to upgrade Vikunja to version 2.6.0 or later, where the developers have implemented proper recursion depth limits and input validation mechanisms for filter expressions. Until an upgrade can be performed, administrators should consider deploying a Web Application Firewall that inspects incoming HTTP requests for patterns indicative of deeply nested structures or excessive query complexity. Rate limiting on the task-filter endpoint may also help mitigate the impact by restricting the number of complex queries a single user can submit within a given timeframe. Additionally, implementing strict input sanitization at the application level to reject filter strings exceeding a reasonable length or nesting depth would provide an additional layer of defense against this specific type of resource exhaustion attack.