CVE-2026-91970: Vikunja before 2.6.0 Resource Exhaustion via Planka Migration
Vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the Planka migrator that fails to enforce aggregate memory budgets during migration jobs. Authenticated attackers can submit migration requests pointing to attacker-controlled servers advertising numerous size-compliant attachments, exhausting worker memory and causing denial of service for all users.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Vikunja (Planka migrator)to a version that resolves this vulnerability.Fixed in 2.6.0 - Compensating control
If immediate upgrade is not possible, limit or restrict authenticated users’ ability to trigger Planka migration jobs to reduce the likelihood of resource-exhaustion denial of service.
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated attacker with permission to submit a Planka migration request can exploit it. The attacker must be able to point the migration at an attacker-controlled server.
What conditions are required for exploitation?
The attacker-controlled server must advertise many attachments that each meet the migrator's size checks. The vulnerability results from the migration job not enforcing an aggregate memory budget across those attachments.
What is the operational impact?
Exploitation can exhaust worker memory and cause denial of service for all users. The provided information does not indicate confidentiality or integrity impact.
What version should be used to remediate the issue?
Upgrade Vikunja to version 2.6.0 or later. Versions before 2.6.0 are affected.