---
id: CVE-2026-91968
title: >-
  vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in
  the task-filter endpoint that accepts deeply nested filter expressions without
  recursion depth limits
summary: >-
  vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in
  the task-filter endpoint that accepts deeply nested filter expressions without
  recursion depth limits. Authenticated attackers can supply thousands of nested
  pa…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-674
vendor: go-vikunja
product: vikunja
affected:
  - vikunja >= 2.5.0 < 2.6.0
published: '2026-09-15'
updated: '2026-09-16'
sourceUpdated: '2026-09-16T20:16:09.343'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-91968'
references:
  - url: >-
      https://github.com/go-vikunja/vikunja/security/advisories/GHSA-xxc3-xpmc-vmvr
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/vikunja-before-2.6.0-denial-of-service-via-unbounded-filter-recursion
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/go-vikunja/vikunja/security/advisories/GHSA-xxc3-xpmc-vmvr
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-15T15:55:42.634396Z'
ingestedAt: '2026-09-15T15:39:12.914Z'
epss: 0.00368
epssPercentile: 0.30514
---

## Overview

vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the task-filter endpoint that accepts deeply nested filter expressions without recursion depth limits. Authenticated attackers can supply thousands of nested parentheses in the filter query parameter to exhaust memory and terminate the API process.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.