CVE-2026-91969: vikunja before 2.6.0 Resource Exhaustion via CSV Migration
vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the POST /api/v2/migration/csv/migrate endpoint that fails to limit parsed row cardinality. Authenticated attackers can upload multipart CSV files with millions of tiny records to exhaust process memory and terminate the API service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
vikunjato a version that resolves this vulnerability.Fixed in 2.6.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated attacker with access to the CSV migration endpoint can exploit it remotely. No user interaction is required.
What does an attacker need to submit?
The attacker needs to upload a multipart CSV file containing millions of very small records to POST /api/v2/migration/csv/migrate. The endpoint does not limit the number of parsed rows.
What is the operational impact?
Processing the crafted CSV can exhaust process memory and terminate the Vikunja API service, causing a denial of service. The provided information does not indicate confidentiality or integrity impact.
Which deployments are affected?
Vikunja versions before 2.6.0 are affected. The issue applies to installations where authenticated users can reach the CSV migration endpoint.