CVE-2026-86255

wger, an open-source workout and fitness tracking application, before version 2.5 fails to validate the maximum duration of routine date ranges, letting any authenticated user create routines that span arbitrarily long periods (CWE-400, uncontrolled resource consumption). When such a routine is accessed, the routine detail endpoints compute the date_sequence, forcing the server to iterate thousands of times per request. An attacker can abuse this to exhaust worker threads and deny service to legitimate users, with high availability impact but no confidentiality or integrity impact (CVSS 4.0: 7.1, network vector, low privileges required). Any deployment running wger prior to 2.5, including self-hosted instances and the project's hosted service, is affected. Exploitation has not been observed: there is no known public proof of concept, EPSS is 0.2% (percentile 16), and the issue is not in CISA KEV.

What to do: Upgrade wger to version 2.5 or later, which adds validation of routine date-range duration. Until patched, limit routine creation to trusted authenticated users, enforce an application-level or reverse-proxy limit on routine date ranges, and monitor worker-thread saturation on routine detail endpoints; audit deployments to confirm the running version.