---
id: CVE-2026-86255
title: >-
  wger before 2.5 fails to validate the maximum duration of routine date ranges,
  allowing authenticated users to create routines spanning arbitrarily long
  periods
summary: >-
  wger before 2.5 fails to validate the maximum duration of routine date ranges,
  allowing authenticated users to create routines spanning arbitrarily long
  periods. Attackers can trigger the date_sequence computation via routine
  detail endp…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-400
vendor: wger
product: wger
affected:
  - wger <= 2.5
published: '2026-09-06'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T18:17:18.790'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-86255'
references:
  - url: >-
      https://github.com/wger-project/wger/security/advisories/GHSA-v25j-wqcw-fvhj
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/wger-before-2.5-uncontrolled-resource-consumption-via-date-sequence
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/wger-project/wger/commit/5f07a4473e2c32d298c8cdd31d78e5107840039c
  - url: 'https://github.com/wger-project/wger'
tags:
  - nvd
  - osv
  - pip
  - cve.org
epss: 0.00249
epssPercentile: 0.16522
aliases:
  - GHSA-v25j-wqcw-fvhj
ecosystem: pip
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-18T17:08:01.047911Z'
ingestedAt: '2026-09-07T04:04:50.717Z'
---

## Overview

wger before 2.5 fails to validate the maximum duration of routine date ranges, allowing authenticated users to create routines spanning arbitrarily long periods. Attackers can trigger the date_sequence computation via routine detail endpoints, forcing the server to iterate thousands of times per request and exhaust worker threads, denying service to legitimate users.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-86255)

Affected packages:

- `wger <= 2.5`

Source: https://osv.dev/vulnerability/GHSA-v25j-wqcw-fvhj