CVE-2026-91969
Received Received - Intake

Resource Exhaustion in Vikunja via Unbounded CSV Rows

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: VulnCheck

Description
vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the POST /api/v2/migration/csv/migrate endpoint that fails to limit parsed row cardinality. Authenticated attackers can upload multipart CSV files with millions of tiny records to exhaust process memory and terminate the API service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-91969
EUVD
EUVD-2026-78645

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
vikunja vikunja to 2.6.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a resource exhaustion issue in Vikunja versions before 2.6.0. It affects the POST /api/v2/migration/csv/migrate endpoint, which does not limit the number of rows parsed from uploaded CSV files. Attackers can exploit this by uploading large CSV files with millions of small records to consume excessive memory, causing the API service to crash.

Detection Guidance

Monitor API service memory usage and process crashes. Check for unusually large CSV uploads to the POST /api/v2/migration/csv/migrate endpoint. Inspect logs for excessive row parsing attempts.

Impact Analysis

If you are a Vikunja user running a vulnerable version, an authenticated attacker could upload malicious CSV files to crash the API service, leading to denial of service. This disrupts access to the application and may cause data unavailability for all users.

Compliance Impact

This vulnerability could indirectly impact compliance with GDPR or HIPAA by causing service disruptions or data processing failures due to API crashes. Resource exhaustion may lead to unavailability of systems handling personal or sensitive data, potentially violating availability requirements under these regulations.

Mitigation Strategies

Upgrade Vikunja to version 2.6.0 or later. Implement rate limiting and size restrictions on file uploads. Monitor and restrict access to the vulnerable endpoint for unauthenticated users.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-91969. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart