CVE-2026-123501

Vikunja versions before 2.7.1 are vulnerable to an uncontrolled resource consumption flaw during avatar and background uploads. An authenticated user can trigger a Memory Exhaustion Denial of Service (DoS) by sending multiple parallel, highly compressible PNG images that decode to sizes up to 50 ...

EUVD-2026-119386

Vikunja before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated users to exhaust server memory through concurrent image decodes in avatar and background uploads. Attackers can send several parallel tiny, highly compressible PNGs decoded at up to 50...

CVE-2026-123501 Vikunja before 2.7.1 Memory Exhaustion DoS via Unbounded Image Decodes

Vikunja before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated users to exhaust server memory through concurrent image decodes in avatar and background uploads. Attackers can send several parallel tiny, highly compressible PNGs decoded at up to 50...

CVE-2026-123501: go-vikunja vikunja: Vikunja before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated users to…

Vikunja before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated users to exhaust server memory through concurrent image decodes in avatar and background uploads. Attackers can send several parallel tiny, highly compressible PNGs decoded at up to 50...