CVE-2026-86255

Name of the Vulnerable Software and Affected Versions wger versions prior to 2.5

Description Authenticated users can create routines with arbitrarily long date ranges because the software fails to validate the maximum duration. By triggering the date sequence computation through routine detail endpoints, an attacker can force the server to perform thousands of iterations per request. This process exhausts worker threads, resulting in a denial of service for legitimate users.

Recommendations Update wger to version 2.5 or later.