Kadirarslan

**Name of the Vulnerable Software and Affected Versions** wger versions prior to 2.5 **Description** Authenticated users can create routines with arbitrarily long date ranges because the software fails to validate the maximum duration. By triggering the `date sequence` computation through routine detail endpoints, an attacker can force the server to perform thousands of iterations per request. This process exhausts worker threads, resulting in a denial of service for legitimate users. **Recommendations** Update wger to version 2.5 or later.