wger Routine Duration Validation Bypass Leads to DoS

Executive Summary

CVE-2026-86255 is a vulnerability in the wger workout manager software where the application fails to validate the maximum duration of routine date ranges. This allows authenticated users to create routines spanning arbitrarily long periods, such as 100 years. When certain endpoints are accessed, the server enters an unbounded loop that iterates once per day within the specified date range, performing heavy computations for each day. This can consume significant server CPU time and return tens of thousands of entries in a single request.

Useful 0 Not Useful 0

Detection Guidance

Monitor for unusually high CPU usage or slow responses from the wger application. Check API logs for requests to routine detail endpoints that return large datasets or take excessive time to process. Look for authenticated users creating routines with date ranges spanning years.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to denial of service for legitimate users. Repeated exploitation can exhaust server worker threads, causing the server to become unresponsive or slow. Attackers can trigger excessive resource consumption via routine detail endpoints, making the application unavailable for other users.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily impacts system availability by causing denial-of-service through resource exhaustion. While not directly violating GDPR or HIPAA, such disruptions could lead to violations if they prevent authorized access to personal data (GDPR Article 32) or protected health information (HIPAA Security Rule). The uncontrolled resource consumption may also indicate inadequate security controls, which could be cited in compliance audits.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade wger to version 2.6 or later to address the issue. Implement input validation to enforce maximum routine durations. Add rate limiting to routine detail endpoints to prevent excessive iterations. Monitor server resources for signs of resource exhaustion.

Useful 0 Not Useful 0