CVE-2026-91971: Vikunja before 2.6.0 Denial of Service via Avatar Upload
Vikunja before 2.6.0 fails to apply pixel decode limits to avatar and project-background upload endpoints, allowing authenticated users to upload crafted images that decode to excessive pixel counts. Attackers can upload small images with extreme aspect ratios that consume significant CPU and memory during processing, causing denial of service through repeated or concurrent uploads.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Vikunja user with access to avatar or project-background uploads can exploit it. No user interaction is required.
Which deployments are affected?
Vikunja versions before 2.6.0 are affected where avatar or project-background upload endpoints are available to authenticated users.
What is required for exploitation?
An attacker needs to upload a crafted image that is small in file size but decodes to an excessive pixel count, such as an image with extreme dimensions. Repeated or concurrent uploads can consume CPU and memory.
How can teams identify possible exploitation?
Investigate unusually frequent or concurrent avatar and project-background uploads, especially uploads associated with CPU or memory exhaustion during image processing.