Resource Exhaustion

code.vikunja.io/api is vulnerable to a resource exhaustion. The vulnerability is due to the failure to limit the number of parsed CSV rows in the /api/v2/migration/csv/migrate endpoint, which allows an authenticated attacker to upload a CSV file containing millions of small records, exhaust proce...

EUVD-2026-78645

Vikunja: Unbounded CSV row cardinality permits API process termination...

GHSA-PQF9-H8G4-8GMH Vikunja: Unbounded CSV row cardinality permits API process termination

Unbounded CSV row cardinality permits API process termination Summary The authenticated v2 CSV migration route caps upload bytes but not parsed row cardinality. It reads every record into a string and then materializes a full task object for every row before insertion. Two million one-cell rows f...

CVE-2026-91969 vikunja before 2.6.0 Resource Exhaustion via CSV Migration

vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the POST /api/v2/migration/csv/migrate endpoint that fails to limit parsed row cardinality. Authenticated attackers can upload multipart CSV files with millions of tiny records to exhaust process memory and terminate the...

CVE-2026-91969 vikunja before 2.6.0 Resource Exhaustion via CSV Migration

vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the POST /api/v2/migration/csv/migrate endpoint that fails to limit parsed row cardinality. Authenticated attackers can upload multipart CSV files with millions of tiny records to exhaust process memory and terminate the...

CVE-2026-91969 vikunja before 2.6.0 Resource Exhaustion via CSV Migration

vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the POST /api/v2/migration/csv/migrate endpoint that fails to limit parsed row cardinality. Authenticated attackers can upload multipart CSV files with millions of tiny records to exhaust process memory and terminate the...

PT-2026-92088

Name of the Vulnerable Software and Affected Versions vikunja versions prior to 2.6.0 Description A resource exhaustion issue exists where the system fails to limit parsed row cardinality. Authenticated attackers can upload multipart CSV files containing millions of small records to the 'POST...