This vulnerability is an uncontrolled resource consumption flaw that allows authenticated users to exhaust server memory by uploading many PNG images that are highly compressible. During avatar or background uploads, the application decodes each image without imposing size limits. Each image can decompress to as many as 50 megapixels, and when numerous such images are processed concurrently the API process consumes massive amounts of memory, ultimately triggering a memory‑pressure response or an operating‑system OOM kill.

Affected systems are deployments of Vikunja provided by go‑vikunja with any version earlier than 2.7.1, including the 2.6.x series and older releases. These installations accept avatar or background image uploads and therefore lack the mitigation added in 2.7.1.

The CVSS base score of 7.1 denotes a high severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker must first obtain authenticated user access to the application. Once authenticated, the attacker can send a burst of PNG files in parallel; because each decompresses to a very large pixel count, the server memory is exhausted, producing a denial of service for all users. The exploitation effort is straightforward and requires no additional privileges beyond normal authenticated access, making the vulnerability a likely target if an attacker gains account credentials.