Vulnerability details

CVE-2026-91979

go-vikunja vikunja

Vikunja before 2.6.0 Denial of Service via Decompression Bomb

CVSS 4.0

7.1High

Official description

Vikunja before 2.6.0 fails to limit archive expansion during data import, allowing authenticated users to cause denial of service. Attackers can upload highly compressed files that expand to tens of gigabytes in memory and disk, exhausting server resources and crashing the instance.

CVSS scores

Score	Version	Source	Vector
7.1High	4.0	CVEProject cvelistV5 (CNA) (VulnCheck)	`CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N`
6.5Medium	3.1	CVEProject cvelistV5 (CNA) (VulnCheck)	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H`

Affected products

Vendor	Product	Versions	Source
go-vikunja	vikunja	v < 2.6.0	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/go-vikunja/vikunja/security/advisories/GHSA-w7jp-mf2v-8342 vendor-advisory
https://www.vulncheck.com/advisories/vikunja-before-2.6.0-denial-of-service-via-decompression-bomb third-party-advisory

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-09-15
Last updated: 2026-09-17
State: Published
Assigner (CNA): VulnCheck

Exploit prediction (EPSS)

0.43%

Probability of exploitation in 30 days

38%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: None
Technical impact: Partial

Weaknesses (CWE)

CWE-400
Uncontrolled Resource Consumption