Medium severity6.5NVD Advisory· Published Nov 8, 2026· Updated Nov 8, 2026

CVE-2026-123525

Description

Vikunja before 2.7.1 allocates memory without limits in its Trello, Todoist and Microsoft To Do migration importers, which buffer remote attachment downloads and API responses in memory without size caps. Authenticated users can start a migration that references huge attacker-served attachments or yields oversized API responses, exhausting memory and crashing the shared API process for all tenants.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Go Vikunja/Vikunjallm-fuzzy
Range: <2.7.1

Patches

Vulnerability mechanics

References

github.com/go-vikunja/vikunja/security/advisories/GHSA-wqjr-22r7-5437nvd
www.vulncheck.com/advisories/vikunja-before-2.7.1-memory-exhaustion-dos-via-trello-todoist-and-microsoft-to-do-migrationsnvd

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000