CVE-2026-91979: Vikunja before 2.6.0 Denial of Service via Decompression Bomb
Vikunja before 2.6.0 fails to limit archive expansion during data import, allowing authenticated users to cause denial of service. Attackers can upload highly compressed files that expand to tens of gigabytes in memory and disk, exhausting server resources and crashing the instance.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Vikunja user can exploit it by importing a highly compressed archive designed to expand to tens of gigabytes. No user interaction is required beyond the attacker’s own authenticated access.
Are default deployments affected?
The provided information does not identify any configuration prerequisite beyond running a Vikunja version before 2.6.0 and allowing authenticated users to perform data imports.
What is the impact of successful exploitation?
Archive expansion can exhaust memory and disk resources, causing denial of service and potentially crashing the Vikunja instance. The supplied severity vector indicates no confidentiality or integrity impact.
What should be done if an immediate upgrade is not possible?
The provided information does not specify a vendor workaround. Reducing or suspending data-import access for untrusted authenticated users can limit the described attack path until an upgrade is possible.