Medium severity6.5NVD Advisory· Published Sep 15, 2026· Updated Sep 21, 2026
CVE-2026-91971
CVE-2026-91971
Description
Vikunja before 2.6.0 fails to apply pixel decode limits to avatar and project-background upload endpoints, allowing authenticated users to upload crafted images that decode to excessive pixel counts. Attackers can upload small images with extreme aspect ratios that consume significant CPU and memory during processing, causing denial of service through repeated or concurrent uploads.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
code.vikunja.io/apiGo | < 2.6.0 | 2.6.0 |
Affected products
2- Range: <2.6.0
Patches
Vulnerability mechanics
References
6- github.com/advisories/GHSA-4vh2-39rq-rq8jghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-91971ghsaADVISORY
- github.com/go-vikunja/vikunja/pull/3688ghsaWEB
- github.com/go-vikunja/vikunja/releases/tag/v2.6.0ghsaWEB
- github.com/go-vikunja/vikunja/security/advisories/GHSA-4vh2-39rq-rq8jnvdWEB
- www.vulncheck.com/advisories/vikunja-before-2.6.0-denial-of-service-via-avatar-uploadnvdWEB
News mentions
1- Go Vikunja: Twelve Vulnerabilities Including Privilege Escalation and Auth Bypass Disclosed TogetherVypr Intelligence · Sep 15, 2026