wger before version 2.5 allows authenticated users to create exercise routines with arbitrarily long date ranges. When routine detail endpoints are called, the application iterates through each day in the range, which can result in thousands of iterations for a single request. This excessive iteration consumes worker threads and CPU, potentially exhausting server resources and denying service to legitimate users.

The vulnerable product is wger, produced by the wger-project. All releases prior to 2.5 are affected because no maximum duration check was implemented before that version.

The CVSS score of 7.1 indicates a moderate to high severity. The EPSS score is unavailable, and the vulnerability is not in the CISA KEV catalog, so known public exploitation data is limited. Attackers need to be authenticated to create the long routines; the vector is through routine detail endpoints that trigger the date_sequence calculation. If an attacker can repeatedly invoke these endpoints, the server may run out of worker threads and become temporarily unavailable, affecting availability but not confidentiality or integrity.