CVE-2026-91970

Vikunja, the self-hosted task-management application, contains a resource exhaustion flaw (CWE-770) in its Planka migrator, which fails to enforce an aggregate memory budget when importing data. An authenticated attacker triggers the bug by submitting a migration request that points to an attacker-controlled Planka server advertising a large number of attachments, each individually within per-file size limits, whose combined in-memory footprint exceeds worker capacity. This exhausts the memory of the Vikunja worker handling migrations, causing a denial of service that affects all users of the instance. All Vikunja deployments before version 2.6.0 are affected, though exploitation requires a valid account and access to the migration feature. The vulnerability is not in CISA's KEV catalog, no public proof of concept is known, and there is no evidence of exploitation in the wild.

What to do: Upgrade Vikunja to version 2.6.0 or later, which enforces aggregate memory budgets during migration jobs. If immediate upgrade is not possible, disable or restrict the Planka migration feature, limit who can create accounts or invoke migrations, and cap container memory so a runaway migration cannot starve the whole instance. Review logs for migration requests referencing unexpected or attacker-controlled Planka server URLs, and monitor worker memory usage during any active migrations.