CVE-2026-86255: wger before 2.5 Uncontrolled Resource Consumption via date_sequence
wger before 2.5 fails to validate the maximum duration of routine date ranges, allowing authenticated users to create routines spanning arbitrarily long periods. Attackers can trigger the datesequence computation via routine detail endpoints, forcing the server to iterate thousands of times per request and exhaust worker threads, denying service to legitimate users.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user can exploit it. The attack does not require user interaction and can be performed over the network.
What action triggers the resource consumption?
The attacker creates a routine with an arbitrarily long date range, then triggers date_sequence processing through routine detail endpoints. This can force thousands of iterations for each request and exhaust server worker threads.
Are installations running version 2.5 affected?
The issue is described as affecting wger versions before 2.5. The provided information does not identify any other affected versions or configurations.