CVE-2026-91969

Vikunja, the open-source self-hosted to-do/task management application, contains a resource exhaustion flaw (CWE-400) in versions before 2.6.0. The POST /api/v2/migration/csv/migrate endpoint fails to limit the cardinality of parsed CSV rows, so any authenticated user can upload a multipart CSV file containing millions of tiny records, causing the API process to consume all available memory and terminate. The impact is denial of service only — CVSS 4.0 scores it 7.1 (high) with low privileges required, network attack vector, and high availability impact, but no confidentiality or integrity impact. All self-hosted Vikunja instances running a version prior to 2.6.0 with user accounts enabled are affected. The flaw is not in the CISA KEV catalog, no public proof-of-concept is known, and no in-the-wild exploitation has been reported.

What to do: Upgrade to Vikunja 2.6.0 or later, which caps parsed row cardinality in the CSV migration endpoint. If immediate patching is not possible, restrict or disable the migration endpoint, limit who can authenticate (e.g., disable open self-registration or use an approved allowlist), and enforce request body size limits and rate limiting at the reverse proxy. Review server logs and container orchestration events for out-of-memory kills or repeated API restarts as evidence of attempted exploitation.