Technical impact
The vulnerability resides in Vikunja’s algorithm for assigning repeat intervals to tasks. An O(n) loop processes each second until a due date is reached, and when a repeating task is set with a 1‑second interval and a start date far in the past, the loop can iterate billions of times. Each iteration consumes CPU cycles and holds a database connection for minutes, effectively saturating the server and causing service interruption. The weakness is identified as a classic algorithmic complexity issue (CWE‑407).
Affected Systems
Any deployment of the open‑source Vikunja task management platform running a version earlier than 2.3.0 is vulnerable. The affected component is the addRepeatIntervalToTime function in the repeating‑task handler.
Risk and Exploitability
The CVSS score of 6.5 indicates a moderate severity. Exploitation does not require elevated privileges or a privileged environment; the likely attack vector is the public‑facing API or any interface that accepts user‑supplied repeating‑task data. Attackers can trigger the DoS by submitting a single malicious task, leading to high CPU load and database lock‑up. No evidence suggests it is in the CISA KEV catalog nor is the EPSS score available, but the impact on availability and the ability to exercise the flaw remotely make it a significant risk for users unable to apply the fix promptly.
Github GHSA