CVE-2026-91971

Name of the Vulnerable Software and Affected Versions Vikunja versions prior to 2.6.0

Description Authenticated users can cause a denial of service by uploading specially crafted images to the avatar and project-background upload endpoints. The software fails to apply pixel decode limits, allowing images with extreme aspect ratios to consume excessive CPU and memory during processing. This can be triggered through repeated or concurrent uploads.

Recommendations Update to version 2.6.0 or later.