PT-2026-118051

Vikunja: Unbounded CSV row cardinality permits API process termination in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...

Vikunja: Unbounded CSV row cardinality permits API process termination

Unbounded CSV row cardinality permits API process termination Summary The authenticated v2 CSV migration route caps upload bytes but not parsed row cardinality. It reads every record into a string and then materializes a full task object for every row before insertion. Two million one-cell rows f...