Medium severity6.5NVD Advisory· Published Sep 6, 2026· Updated Sep 18, 2026

CVE-2026-86255

Description

wger before 2.5 fails to validate the maximum duration of routine date ranges, allowing authenticated users to create routines spanning arbitrarily long periods. Attackers can trigger the date_sequence computation via routine detail endpoints, forcing the server to iterate thousands of times per request and exhaust worker threads, denying service to legitimate users.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Wger Project/Wgerllm-fuzzy
Range: <2.5

Patches

Vulnerability mechanics

References

github.com/wger-project/wger/security/advisories/GHSA-v25j-wqcw-fvhjnvd
www.vulncheck.com/advisories/wger-before-2.5-uncontrolled-resource-consumption-via-date-sequencenvd

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000