CVE-2026-123525
Deferred Deferred - Pending Action

Vikunja Memory Exhaustion in Migration Importers

Publication date: 2026-11-08

Last updated on: 2026-11-08

Assigner: VulnCheck

Description
Vikunja before 2.7.1 allocates memory without limits in its Trello, Todoist and Microsoft To Do migration importers, which buffer remote attachment downloads and API responses in memory without size caps. Authenticated users can start a migration that references huge attacker-served attachments or yields oversized API responses, exhausting memory and crashing the shared API process for all tenants.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-08
Last Modified
2026-11-08
Generated
2026-11-08
AI Q&A
2026-11-08
EPSS Evaluated
N/A
NVD
CVE-2026-123525
EUVD
EUVD-2026-119410

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
vikunja vikunja to 2.7.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Vikunja versions before 2.7.1 have a memory exhaustion vulnerability in migration importers for Trello, Todoist, and Microsoft To Do. The app buffers remote attachments and API responses without size limits, allowing authenticated users to crash the shared API process by triggering out-of-memory conditions.

Detection Guidance

Monitor for high memory usage in the Vikunja API process during migration operations. Check for crashes or OOM kills in the API service logs. Look for large memory allocations in migration-related endpoints, particularly when users initiate Trello, Todoist, or Microsoft To Do migrations.

Impact Analysis

An attacker with authenticated access could exploit this to cause a denial-of-service, crashing the Vikunja API for all tenants. This disrupts service availability until the API is restarted.

Mitigation Strategies

Upgrade Vikunja to version 2.7.1 or later to apply the memory allocation fixes. Disable migration features for Trello, Todoist, and Microsoft To Do if not needed. Implement network-level restrictions to block large file downloads during migrations. Monitor API memory usage closely after applying updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-123525. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...