CVE-2026-35599 go-vikunja CVE debrief

Who should care

Defenders managing Vikunja installations, especially those with publicly accessible task management systems or high-availability requirements, should assess exposure and apply the patch.

Why it matters

CVE-2026-35599 is a vulnerability in Vikunja that can lead to denial-of-service conditions. Defenders managing Vikunja installations should assess exposure and apply the patch to prevent potential abuse and system performance issues.

• Denial-of-service conditions through CPU consumption.
• Prolonged database connection hold times.
• Potential for abuse through specially crafted tasks.

Technical summary

The addRepeatIntervalToTime function in Vikunja has an O(n) loop that can be exploited by creating a repeating task with a 1-second interval and a due date far in the past, leading to CPU consumption and prolonged database connection hold times. This issue is particularly concerning for defenders managing Vikunja installations, especially those with publicly accessible task management systems or high-availability requirements, as it can lead to denial-of-service conditions. The vulnerability is fixed in version 2.3.0, and defenders should prioritize verifying exposure and applying the patch.

Defensive priority

Defenders should prioritize verifying exposure and applying the patch, as the vulnerability can lead to denial-of-service conditions.

Recommended defensive actions

• Verify if the system is using a version of Vikunja prior to 2.3.0.
• Apply the patch by updating to Vikunja version 2.3.0 or later.
• Monitor system performance and database connections for unusual activity.
• Review task configurations for potential abuse.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impact, and the fixed version. Additional information on potential exploitation or affected systems is limited. Defenders should verify exposure by checking if the system is using a version of Vikunja prior to 2.3.0 and review task configurations for potential abuse. The CVE Program and NVD entries offer official details, but further research may be needed to understand the full scope of affected systems and potential mitigations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.