GHSA-55p4-8j34-jv53

Duplicate Advisory: Vikunja: Unbounded CSV row cardinality permits API process termination

Published

2026-09-15

Modified

2026-10-09

Sources

github-advisory

Summary

### Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-pqf9-h8g4-8gmh. This link is maintained to preserve external references. ### Original Description vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the POST /api/v2/migration/csv/migrate endpoint that fails to limit parsed row cardinality. Authenticated attackers can upload multipart CSV files with millions of tiny records to exhaust process memory and terminate the API service.

Affected packages

Remediation: No patched version is listed by GitHub.

References

• https://github.com/advisories/GHSA-55p4-8j34-jv53