CVE-2026-123501

Name of the Vulnerable Software and Affected Versions Vikunja versions prior to 2.7.1

Description Authenticated users can cause server memory exhaustion through concurrent image decodes during avatar and background uploads. By sending multiple parallel, highly compressible PNG files that decode to up to 50 megapixels each, an attacker can trigger memory pressure or an Out-Of-Memory (OOM) kill—a process where the operating system terminates the API process to reclaim memory—effectively leading to a denial of service.

Recommendations Update to version 2.7.1 or later.