Vikunja before version 2.7.1 contains a memory exhaustion flaw that allows an authenticated user to upload a large WeKan or Vikunja-file import without any item‑count restriction, which can trigger an out‑of‑memory condition and crash the API process. The vulnerability is a classic Denial of Service, as it renders the instance unavailable after the crash.

The affected product is Vikunja (go‑vikunja:vikunja) and any deployment of the application running any version prior to 2.7.1. The flaw is confined to the endpoints that handle WeKan or Vikunja-file imports; older releases of the API without these import features are not impacted.

The CVSS score of 7.1 classifies the risk as high. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that it may not yet have known widespread exploitation. Attackers must be authenticated, most likely via an API key or user session, and then submit a large import file to the wekan migrate endpoint; the lack of an item‑count cap allows hundreds of thousands of items to be processed, which can exhaust memory and force the process to terminate. The likely attack vector is a crafted HTTP POST to the import endpoint carrying a ~22 MB WeKan JSON file with many cards or duplicate IDs.