CVE-2026-91971 go-vikunja CVE debrief

Who should care

System administrators and security teams responsible for Vikunja installations should assess exposure and prioritize upgrading to version 2.6.0 or later to mitigate potential denial-of-service attacks.

Why it matters

CVE-2026-91971 is a high-severity vulnerability in Vikunja before version 2.6.0, allowing authenticated users to upload crafted images that can cause denial of service. Defenders should prioritize verifying and upgrading to Vikunja version 2.6.0 or later, restrict image upload and processing privileges, and monitor system resources.

• Potential denial-of-service through excessive CPU and memory consumption
• Need to verify and upgrade to Vikunja version 2.6.0 or later
• Importance of restricting image upload and processing privileges to trusted users
• Monitoring system resources for unusual patterns indicative of potential attacks

Technical summary

The vulnerability exists in Vikunja before version 2.6.0, where the application fails to apply pixel decode limits to avatar and project-background upload endpoints. This allows authenticated users to upload small images with extreme aspect ratios that can consume significant CPU and memory during processing, potentially leading to denial-of-service attacks. The vulnerability has a high CVSS score of 7.1, indicating a high severity. Defenders should prioritize verifying and upgrading to Vikunja version 2.6.0 or later to prevent potential denial-of-service attacks through crafted image uploads. Additionally, defenders should restrict image upload and processing privileges to trusted users and monitor system

Defensive priority

Defenders should prioritize verifying and upgrading to Vikunja version 2.6.0 or later to prevent potential denial-of-service attacks through crafted image uploads.

Recommended defensive actions

• Verify and upgrade to Vikunja version 2.6.0 or later
• Restrict image upload and processing privileges to trusted users
• Monitor system resources for unusual patterns indicative of potential attacks
• Implement additional logging and monitoring to detect potential attacks
• Conduct regular security audits to identify potential vulnerabilities
• Review and update incident response plans to include denial-of-service attack scenarios
• Ensure that security teams are trained to respond to potential attacks

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its high CVSS score of 7.1 and the potential for denial-of-service attacks through crafted image uploads. The vulnerability allows authenticated users to upload small images with extreme aspect ratios that can consume significant CPU and memory during processing. Defenders should verify and upgrade to Vikunja version 2.6.0 or later, restrict image upload and processing privileges to trusted users, and monitor system resources for unusual patterns indicative 0

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.