CVE-2026-91968: vikunja before 2.6.0 Denial of Service via unbounded filter recursion
vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the task-filter endpoint that accepts deeply nested filter expressions without recursion depth limits. Authenticated attackers can supply thousands of nested parentheses in the filter query parameter to exhaust memory and terminate the API process.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
vikunjato a version that resolves this vulnerability.Fixed in 2.6.0 - Compensating control
Apply rate limiting / request throttling and restrict access to the task-filter endpoint to reduce the impact of deeply nested filter expressions until the service is upgraded to 2.6.0.
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated attacker who can send requests to the task-filter endpoint can exploit it. No user interaction is required.
What input triggers the denial of service?
The attacker supplies a filter query parameter containing thousands of deeply nested parentheses. The endpoint processes these expressions without a recursion-depth limit, exhausting memory and terminating the API process.
Are deployments running Vikunja 2.6.0 affected?
No. The affected versions are Vikunja releases before 2.6.0.