CVE-2026-91968

Name of the Vulnerable Software and Affected Versions vikunja versions prior to 2.6.0

Description A resource exhaustion issue exists in the '/task-filter' endpoint. The system accepts deeply nested filter expressions without enforcing recursion depth limits. Authenticated attackers can provide thousands of nested parentheses via the filter query parameter to exhaust system memory, leading to the termination of the API process.

Recommendations Update to version 2.6.0 or later. As a temporary mitigation, restrict the use of the filter parameter in the '/task-filter' endpoint.