CVE-2026-123519
Deferred Deferred - Pending Action

Vikunja API DoS via WeKan Import Memory Exhaustion

Publication date: 2026-11-08

Last updated on: 2026-11-08

Assigner: VulnCheck

Description
Vikunja before 2.7.1 contains a denial of service vulnerability that allows authenticated users to exhaust API process memory by uploading WeKan or vikunja-file imports with no item-count cap. Attackers can submit a ~22 MB WeKan JSON with hundreds of thousands of cards or duplicate IDs to the wekan migrate endpoint, triggering OOM and crashing the instance.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-08
Last Modified
2026-11-08
Generated
2026-11-08
AI Q&A
2026-11-08
EPSS Evaluated
N/A
NVD
CVE-2026-123519
EUVD
EUVD-2026-119404

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
vikunja vikunja to 2.7.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-123519 is a denial of service vulnerability in Vikunja versions before 2.7.1. It allows authenticated users to upload large WeKan or vikunja-file imports without item-count limits, causing the API process to exhaust memory and crash due to an out-of-memory condition.

Detection Guidance

Monitor API process memory usage during import operations. Check for unusually large JSON uploads to the /api/v1/wekan/migrate or /api/v1/vikunja-file/import endpoints. Look for processes exceeding normal memory limits or crashing due to OOM conditions.

Impact Analysis

This vulnerability can cause full-instance denial of service due to memory exhaustion. Attackers can crash the entire Vikunja instance by uploading a ~22 MB JSON file with hundreds of thousands of cards or duplicate IDs, leading to a database write storm and prolonged downtime.

Mitigation Strategies

Upgrade Vikunja to version 2.7.1 or later. Implement network-level restrictions to block large JSON uploads to import endpoints. Monitor and limit user upload sizes. Apply rate limiting to migration endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-123519. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...