Vikunja versions prior to 2.7.1 allow an authenticated user to request avatar images at many distinct sizes, causing the application to cache a large amount of data for each request. The unchecked growth of the avatar cache can reach roughly one gigabyte per account without eviction, which eventually exhausts system memory and forces the API process to be OOM‑killed. This uncontrolled resource consumption results in a denial of service for the affected instance.

The vulnerability affects Vikunja installations from the go‑vikunja vendor, specifically any release before version 2.7.1. All users of these releases that are able to upload avatars are susceptible.

The CVSS score of 7.1 classifies this issue as high severity, and the exploit probability is currently unknown because no EPSS value is available. The vulnerability is not listed in CISA’s KEV catalog. Attackers need authenticated access to perform the exploit, and they can trigger it by repeatedly downloading avatar images at incrementally larger sizes. Successful exploitation leads to immediate service disruption for the affected host.