Vikunja versions starting at 1.0.0-rc0 and continuing through 2.1.x decode images during preview generation without any limits on image size or resolution. Attackers can submit highly compressed images that appear small but contain extremely large dimensions, forcing the system to allocate excessive CPU and memory resources. This uncontrolled consumption can halt the service and make the application unavailable to all users, representing a classic denial‑of‑service attack.

The affected software is the Vikunja self‑hosted task management platform. All releases from the initial 1.0.0‑rc0 up to, but not including, version 2.2.0 are vulnerable. Version 2.2.0 and any subsequent releases contain the patch that removes the unbounded decoding behavior.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score below 1% suggests the likelihood of exploitation is low at present. Since the vulnerability is not listed in CISA’s KEV catalog, there is no confirmed large‑scale exploitation. The typical attack vector is a remote HTTP request that triggers image preview processing—an attacker can upload or reference a malicious image through the web interface or API, leading the server to perform the expensive decoding and resizing operation. If successful, the attacker can exhaust system resources and bring the application, and potentially the hosting environment, offline.