Medium severity6.5NVD Advisory· Published Sep 15, 2026· Updated Sep 16, 2026
CVE-2026-91968
CVE-2026-91968
Description
vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the task-filter endpoint that accepts deeply nested filter expressions without recursion depth limits. Authenticated attackers can supply thousands of nested parentheses in the filter query parameter to exhaust memory and terminate the API process.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
code.vikunja.io/apiGo | >= 2.5.0, < 2.6.0 | 2.6.0 |
Affected products
2Patches
Vulnerability mechanics
References
6- github.com/advisories/GHSA-xxc3-xpmc-vmvrghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-91968ghsaADVISORY
- github.com/go-vikunja/vikunja/pull/3688ghsaWEB
- github.com/go-vikunja/vikunja/releases/tag/v2.6.0ghsaWEB
- github.com/go-vikunja/vikunja/security/advisories/GHSA-xxc3-xpmc-vmvrnvdWEB
- www.vulncheck.com/advisories/vikunja-before-2.6.0-denial-of-service-via-unbounded-filter-recursionnvdWEB
News mentions
0No linked articles in our index yet.