CVE-2026-123523 Vikunja before 2.7.1 Memory Exhaustion via Unbounded Avatar Size Cache

Vikunja before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated users to exhaust server memory by requesting avatars at many distinct sizes. Attackers can upload a noisy avatar and fetch it at each size up to 1024, caching roughly a gigabyte per account...

CVE-2026-123523

Vikunja versions prior to 2.7.1 are vulnerable to a memory exhaustion flaw (CWE-770) caused by an unbounded avatar size cache . An authenticated attacker can trigger this by uploading a