CVE-2026-123523

Vikunja before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated users to exhaust server memory by requesting avatars at many distinct sizes. Attackers can upload a noisy avatar and fetch it at each size up to 1024, caching roughly a gigabyte per account without eviction and causing the API process to be OOM-killed.

Referanslar

• https://github.com/go-vikunja/vikunja/security/advisories/GHSA-3x3m-2j93-w46j
• https://www.vulncheck.com/advisories/vikunja-before-2.7.1-memory-exhaustion-via-unbounded-avatar-size-cache