CVE-2026-91970

Name of the Vulnerable Software and Affected Versions Vikunja versions prior to 2.6.0

Description A resource exhaustion issue exists in the Planka migrator, which fails to enforce aggregate memory budgets during migration jobs. Authenticated attackers can trigger this by submitting migration requests that point to servers under their control. These servers can advertise a large number of size-compliant attachments, leading to the exhaustion of worker memory and resulting in a denial of service for all users.

Recommendations Update to version 2.6.0 or later.