CVE-2026-123523
Deferred Deferred - Pending Action

Uncontrolled Resource Consumption in Vikunja via Avatar Size Requests

Publication date: 2026-11-08

Last updated on: 2026-11-08

Assigner: VulnCheck

Description
Vikunja before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated users to exhaust server memory by requesting avatars at many distinct sizes. Attackers can upload a noisy avatar and fetch it at each size up to 1024, caching roughly a gigabyte per account without eviction and causing the API process to be OOM-killed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-08
Last Modified
2026-11-08
Generated
2026-11-08
AI Q&A
2026-11-08
EPSS Evaluated
N/A
NVD
CVE-2026-123523
EUVD
EUVD-2026-119408

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
vikunja vikunja to 2.7.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Vikunja before version 2.7.1 allows authenticated users to exhaust server memory by requesting avatars at many distinct sizes. The avatar endpoint caches resized copies of user avatars for every distinct size requested without eviction, causing memory usage to spike significantly. A single user can occupy around 1 gigabyte of memory, leading to out-of-memory conditions and potential crashes.

Detection Guidance

Monitor server memory usage and API process crashes. Check for repeated avatar size requests in logs. Use tools like 'top', 'htop', or 'ps' to observe memory consumption spikes. Look for processes being OOM-killed.

Impact Analysis

This vulnerability can cause server instability by exhausting available memory, leading to crashes or degraded performance. If exploited by an attacker, it may result in denial-of-service conditions, making the service unavailable for legitimate users. Organizations using vulnerable versions risk operational disruptions and potential data loss.

Mitigation Strategies
  • Upgrade Vikunja to version 2.7.1 or later to apply the patch.
  • Disable open registration if enabled to reduce attack surface.
  • Enable rate limiting on avatar requests to prevent excessive caching.
  • Restart the Vikunja service to clear existing cached avatar sizes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-123523. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...