{"id":"EUVD-2026-21426","enisaUuid":"db9d43a6-0521-37c8-b102-83f9d173b957","description":"Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the addRepeatIntervalToTime function uses an O(n) loop that advances a date by the task\u0027s RepeatAfter duration until it exceeds the current time. By creating a repeating task with a 1-second interval and a due date far in the past, an attacker triggers billions of loop iterations, consuming CPU and holding a database connection for minutes per request. This vulnerability is fixed in 2.3.0.","datePublished":"Apr 10, 2026, 4:05:57 PM","dateUpdated":"Apr 10, 2026, 6:28:29 PM","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-r4fg-73rc-hhh7\nhttps://github.com/go-vikunja/vikunja/pull/2577\nhttps://github.com/go-vikunja/vikunja/commit/6df0d6c8f54b01db6464c42810e40e55f12b481b\nhttps://github.com/go-vikunja/vikunja/releases/tag/v2.3.0\n","aliases":"CVE-2026-35599\nGHSA-r4fg-73rc-hhh7\n","assigner":"GitHub_M","epss":0.35,"enisaIdProduct":[{"id":"aab84116-cafe-39f3-b2ac-0cfae3a2990c","product":{"name":"vikunja","vendor":{"name":"go-vikunja"}},"product_version":"\u003c 2.3.0"}],"enisaIdVendor":[{"id":"d7a92566-8d99-311b-acf6-40ba5d695edc","vendor":{"name":"go-vikunja"}}],"enisaIdVulnerability":[{"id":"23c83589-d361-3f28-97f4-28b526d8f3f1","vulnerability":{"id":"CVE-2026-35599","description":"Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the addRepeatIntervalToTime function uses an O(n) loop that advances a date by the task\u0027s RepeatAfter duration until it exceeds the current time. By creating a repeating task with a 1-second interval and a due date far in the past, an attacker triggers billions of loop iterations, consuming CPU and holding a database connection for minutes per request. This vulnerability is fixed in 2.3.0.","datePublished":"Apr 10, 2026, 4:05:57 PM","dateUpdated":"Apr 10, 2026, 6:28:29 PM","status":"PUBLISHED","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-r4fg-73rc-hhh7\nhttps://github.com/go-vikunja/vikunja/pull/2577\nhttps://github.com/go-vikunja/vikunja/commit/6df0d6c8f54b01db6464c42810e40e55f12b481b\nhttps://github.com/go-vikunja/vikunja/releases/tag/v2.3.0\n","enisa_id":"EUVD-2026-21426\n","assigner":"GitHub_M","epss":0.35,"dataProcessed":"Oct 27, 2026, 7:18:59 AM","vulnerabilityProduct":[{"id":"805030de-1312-3f9e-ac82-6002129accc6","product":{"name":"vikunja","vendor":{"name":"go-vikunja"}},"product_version":"\u003c 2.3.0"}],"vulnerabilityVendor":[{"id":"1b529837-b322-31ed-a927-d91173e537c6","vendor":{"name":"go-vikunja"}}]}},{"id":"c6b0ed06-ba8a-362c-8c7b-8094693de984","vulnerability":{"id":"GHSA-r4fg-73rc-hhh7","description":"Vikunja has Algorithmic Complexity DoS in Repeating Task Handler","datePublished":"Apr 10, 2026, 3:34:41 PM","dateUpdated":"Apr 10, 2026, 7:36:35 PM","baseScore":0.0,"references":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-r4fg-73rc-hhh7\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-35599\nhttps://github.com/go-vikunja/vikunja/pull/2577\nhttps://github.com/go-vikunja/vikunja/commit/6df0d6c8f54b01db6464c42810e40e55f12b481b\nhttps://github.com/go-vikunja/vikunja\nhttps://github.com/go-vikunja/vikunja/releases/tag/v2.3.0\n","enisa_id":"EUVD-2026-21426\n","aliases":"CVE-2026-35599\nGHSA-r4fg-73rc-hhh7\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:10 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}