{"id":"EUVD-2026-78645","enisaUuid":"40c98cb0-e607-3a22-93bd-b5401a150678","description":"vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the POST /api/v2/migration/csv/migrate endpoint that fails to limit parsed row cardinality. Authenticated attackers can upload multipart CSV files with millions of tiny records to exhaust process memory and terminate the API service.","datePublished":"Sep 15, 2026, 3:18:20 PM","dateUpdated":"Sep 17, 2026, 7:28:14 PM","baseScore":7.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-pqf9-h8g4-8gmh\nhttps://www.vulncheck.com/advisories/vikunja-before-2.6.0-resource-exhaustion-via-csv-migration\n","aliases":"CVE-2026-91969\nGHSA-55p4-8j34-jv53\nGHSA-pqf9-h8g4-8gmh\n","assigner":"VulnCheck","epss":0.35,"enisaIdProduct":[{"id":"56cbc936-0fd3-34e0-9bdb-232690e1cff2","product":{"name":"vikunja","vendor":{"name":"go-vikunja"}},"product_version":"2.5.0 \u003c2.6.0"}],"enisaIdVendor":[{"id":"91d08186-bcff-34ea-b2a0-df54e666dbdc","vendor":{"name":"go-vikunja"}}],"enisaIdVulnerability":[{"id":"00e96074-b386-37dd-b700-754dbcd653b7","vulnerability":{"id":"GHSA-55p4-8j34-jv53","description":"Duplicate Advisory: Vikunja: Unbounded CSV row cardinality permits API process termination","datePublished":"Sep 15, 2026, 6:32:30 PM","dateUpdated":"Oct 9, 2026, 8:53:08 PM","baseScore":0.0,"references":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-pqf9-h8g4-8gmh\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-91969\nhttps://www.vulncheck.com/advisories/vikunja-before-2.6.0-resource-exhaustion-via-csv-migration\n","enisa_id":"EUVD-2026-78645\n","aliases":"GHSA-55p4-8j34-jv53\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 2:01:07 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"a3a0e519-65bc-3294-ab3b-75c4bd83a5cc","vulnerability":{"id":"GHSA-pqf9-h8g4-8gmh","description":"Vikunja: Unbounded CSV row cardinality permits API process termination","datePublished":"Oct 9, 2026, 8:53:14 PM","dateUpdated":"Oct 9, 2026, 8:53:14 PM","baseScore":0.0,"references":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-pqf9-h8g4-8gmh\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-91969\nhttps://github.com/go-vikunja/vikunja/pull/3688\nhttps://github.com/go-vikunja/vikunja\nhttps://github.com/go-vikunja/vikunja/releases/tag/v2.6.0\nhttps://www.vulncheck.com/advisories/vikunja-before-2.6.0-resource-exhaustion-via-csv-migration\n","enisa_id":"EUVD-2026-78645\n","aliases":"CVE-2026-91969\nGHSA-pqf9-h8g4-8gmh\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 2:02:26 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"bfecd887-7160-3f6f-b7fc-0bbd945c1f3c","vulnerability":{"id":"CVE-2026-91969","description":"vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the POST /api/v2/migration/csv/migrate endpoint that fails to limit parsed row cardinality. Authenticated attackers can upload multipart CSV files with millions of tiny records to exhaust process memory and terminate the API service.","datePublished":"Sep 15, 2026, 3:18:20 PM","dateUpdated":"Sep 17, 2026, 7:28:14 PM","status":"PUBLISHED","baseScore":7.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-pqf9-h8g4-8gmh\nhttps://www.vulncheck.com/advisories/vikunja-before-2.6.0-resource-exhaustion-via-csv-migration\n","enisa_id":"EUVD-2026-78645\n","assigner":"VulnCheck","epss":0.35,"dataProcessed":"Oct 30, 2026, 7:17:29 AM","vulnerabilityProduct":[{"id":"9607b7ba-eff3-3e61-9a34-cef1da62526d","product":{"name":"vikunja","vendor":{"name":"go-vikunja"}},"product_version":"2.5.0 \u003c2.6.0"}],"vulnerabilityVendor":[{"id":"4445bd88-111c-342d-8593-89bfefe4f73e","vendor":{"name":"go-vikunja"}}]}}],"enisaIdAdvisory":[]}