CVE-2026-91979

Vikunja before 2.6.0 Denial of Service via Decompression Bomb

Published Sep 15, 2026 CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Description

Vikunja before 2.6.0 fails to limit archive expansion during data import, allowing authenticated users to cause denial of service. Attackers can upload highly compressed files that expand to tens of gigabytes in memory and disk, exhausting server resources and crashing the instance.

Analysis

Technical impact

Vikunja, before version 2.6.0, does not restrict the expansion of archives that are imported by users. An attacker can create a highly compressed file that, when decompressed by the application, expands into tens gigabytes of data in memory and on disk. This uncontrolled growth can exhaust server resources, causing the service to become unresponsive or crash, thereby achieving a denial of service.

Affected Systems

The vulnerability affects the Vikunja application, any instance running a version earlier than 2.6.0. Users who are authenticated in the system can upload the malicious archive during the import process.

Risk and Exploitability

The severity of the issue is reflected in a CVSS score of 7.1, indicating a moderately high potential impact. The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog. Attackers need only to be authenticated to the application; the flaw allows them to upload a specific file type that triggers massive unbounded decompression. Once the attuned archive is processed, the server’s memory and disk resources are consumed, leading to service disruption.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

go-vikunja

vikunja

unaffected

Version	Status	Constraints
`0`	affected	< 2.6.0
`2.6.0`	unaffected	—

No data.

Vendor Product Versions

Go-vikunja

Vikunja

Version	Status	Scheme	Platform
`[0,2.6.0)`	affected	generic	—
`2.6.0`	unaffected	semver	—

Vikunja

Version	Status	Scheme	Platform
`[0,2.6.0)`	affected	generic	—
`2.6.0`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update Vikunja to version 2.6.0 or later to apply the official fix for this archiving issue.
Configure the application to limit the maximum size of uploaded archives to a safe threshold, preventing excessive memory or disk consumption during import.
Implement system resource limits or cgroups to constrain memory and disk usage per instance, reducing impact of potential decompression bombs.

Generated by OpenCVE AI on September 20, 2026 at 16:17 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-w7jp-mf2v-8342	Vikunja: Denial of service via decompression bomb in the data import

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.436% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/go-vikunja/vikunja/security/advisories/GHSA-w7jp-mf2v-8342
https://www.vulncheck.com/advisories/vikunja-before-2.6.0-denial-of-service-via-decompression-bomb

History

Sep 17, 2026 8:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 15, 2026 5:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Go-vikunja Go-vikunja vikunja
Vendors & Products		Go-vikunja Go-vikunja vikunja

Sep 15, 2026 3:30 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Vikunja before 2.6.0 fails to limit archive expansion during data import, allowing authenticated users to cause denial of service. Attackers can upload highly compressed files that expand to tens of gigabytes in memory and disk, exhausting server resources and crashing the instance.
Title		Vikunja before 2.6.0 Denial of Service via Decompression Bomb
First Time appeared		Vikunja Vikunja vikunja
Weaknesses		CWE-400
CPEs		cpe:2.3:a:vikunja:vikunja::::::::
Vendors & Products		Vikunja Vikunja vikunja
References		https://github.com/go-vikunja/vikunja/security/advisories/GHSA-w7jp-mf2v-8342 https://www.vulncheck.com/advisories/vikunja-before-2.6.0-denial-of-service-via-decompression-bomb
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` cvssV4_0 `{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}`