{"id":"CVE-2026-91969","title":"vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the POST /api/v2/migration/csv/migrate endpoint that fails to limit parsed row cardinality","summary":"vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the POST /api/v2/migration/csv/migrate endpoint that fails to limit parsed row cardinality. Authenticated attackers can upload multipart CSV files with millions…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-400"],"vendor":"go-vikunja","product":"vikunja","affected":["vikunja >= 2.5.0 < 2.6.0"],"published":"2026-09-15","updated":"2026-09-17","sourceUpdated":"2026-09-17T20:18:54.533","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91969","references":[{"url":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-pqf9-h8g4-8gmh","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/vikunja-before-2.6.0-resource-exhaustion-via-csv-migration","label":"disclosure@vulncheck.com"}],"tags":["nvd","cve.org"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-17T19:16:21.978485Z"},"epss":0.00338,"epssPercentile":0.27383,"ingestedAt":"2026-09-15T15:39:12.914Z","slug":"CVE-2026-91969","body":"## Overview\n\nvikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the POST /api/v2/migration/csv/migrate endpoint that fails to limit parsed row cardinality. Authenticated attackers can upload multipart CSV files with millions of tiny records to exhaust process memory and terminate the API service.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}