# CVE-2026-86255: wger Uncontrolled Resource Consumption in date_sequence

Source: https://junglewise.ai/threats/cve-2026-86255-wger-uncontrolled-resource-consumption-in-date-sequence  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-06. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-86255 · Severity: medium · CVSS 6.5 · Published 2026-09-06

wger is a workout management and fitness tracking application. Authenticated users can exploit insufficient validation of routine date ranges to create routines spanning 100+ years, then trigger expensive server-side computations that force the application to process tens of thousands of entries per request. This allows attackers to exhaust server resources and deny legitimate users access to the service.

Technologies: [wger (PyPI)](https://junglewise.ai/threats/technologies/wger). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-86255 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86255 being exploited in the wild.

**How severe is CVE-2026-86255?** Medium severity, with a CVSS score of 6.5, published 6 September 2026.

**Which products and versions are affected?** wger (PyPI) ECOSYSTEM:introduced=0,last_affected=2.5.

**Is there a fix for CVE-2026-86255?** A patch was published on 2026: Fixed in version 2.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-86255 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-86255?** Check whether you run wger (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability stems from missing maximum duration validation on routine date ranges in the Routine model (wger/manager/models/routine.py). The date_sequence property uses an unbounded while loop that iterates once per day between start and end dates with no upper limit, performing O(slots × entries × configs) work per iteration. An authenticated attacker can create a routine spanning 100 years (36,525+ iterations) and trigger the computation via five API endpoints (/api/v2/routine/{id}/date-sequence-display/, -gym/, /structure/, /logs/, /stats/), each single request consuming multiple seconds of CPU and returning tens of thousands of entries. Repeated requests exhaust worker threads and deny service to other users. The issue is patched in version 2.6 by adding maximum duration validation.

## Affected products

- wger project wger before 2.5

## Identifiers

- CVE-2026-86255
- GHSA-v25j-wqcw-fvhj

## Timeline

- 2026-05-08: disclosed
- 2026-09-06: published
- 2026: patched: Fixed in version 2.6

## References

- [https://github.com/wger-project/wger/security/advisories/GHSA-v25j-wqcw-fvhj](https://github.com/wger-project/wger/security/advisories/GHSA-v25j-wqcw-fvhj)
- [https://www.vulncheck.com/advisories/wger-before-2.5-uncontrolled-resource-consumption-via-date-sequence](https://www.vulncheck.com/advisories/wger-before-2.5-uncontrolled-resource-consumption-via-date-sequence)

## Related threats

- [wger authorization bypass in workout log entry creation](https://junglewise.ai/threats/cve-2026-46438-wger-cross-user-data-corruption-via-missing-ownership-check-on)
- [wger Trainer privilege escalation in user deactivation](https://junglewise.ai/threats/cve-2026-46434-wger-trainer-privilege-escalation-improper-privilege-management)
- [wger API credentials remain valid after logout/password change](https://junglewise.ai/threats/cve-2026-46437-wger-api-credentials-remain-valid-after-logout-password-change)
- [wger trainer_login CSRF bypass via GET request](https://junglewise.ai/threats/cve-2026-45161-wger-trainer-login-accepts-get-csrf-bypass-enables-forced-session)
- [wger gym-scope guard bypass allows cross-tenant admin notes leak](https://junglewise.ai/threats/cve-2026-43976-wger-cross-tenant-admin-notes-contracts-leak-via-gym-none-bypass)