GHSA-g2xc-jv9q-46wq: Vikunja before 2.7.1 Memory Exhaustion DoS via WeKan and Vikunja-File Imports

Published Nov 8, 2026

Updated

Vikunja before 2.7.1 contains a denial of service vulnerability that allows authenticated users to exhaust API process memory by uploading WeKan or vikunja-file imports with no item-count cap. Attackers can submit a ~22 MB WeKan JSON with hundreds of thousands of cards or duplicate IDs to the wekan migrate endpoint, triggering OOM and crashing the instance.

Event History

Nov 8, 2026

CVE Published

via OSV·01:37 AM

Data Sourced

via OSV·01:37 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated Vikunja user can exploit it by submitting a crafted import to the affected API endpoint. The described attack uses WeKan JSON or vikunja-file imports.

What is required to trigger the denial of service?

The attacker needs a valid authenticated session and a crafted import containing an excessive number of items, such as hundreds of thousands of WeKan cards. Duplicate IDs in a WeKan import can also trigger the condition through the wekan migrate endpoint.

What happens when exploitation succeeds?

API process memory can be exhausted, causing an out-of-memory condition and crashing the Vikunja instance.

Which versions are affected?

Vikunja versions before 2.7.1 are affected.

GHSA-g2xc-jv9q-46wq: Vikunja before 2.7.1 Memory Exhaustion DoS via WeKan and Vikunja-File Imports

Event History

Frequently Asked Questions

Who can exploit this issue?

What is required to trigger the denial of service?

What happens when exploitation succeeds?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is required to trigger the denial of service?

What happens when exploitation succeeds?

Which versions are affected?