Executive brief
Vikunja is a task management and project organization API used by teams to collaborate on work items. A vulnerability in its task-filtering endpoint allows authenticated users to submit filter queries with deeply nested expressions that exhaust the API server's memory, crashing the process and denying service to all users. An attacker with basic user credentials can trigger this denial of service with a single malicious API request.
Technical details
This is a recursive parser vulnerability (CWE-674) in the task-filter endpoint (GET /api/v2/projects/{project}/tasks?filter=) that fails to enforce depth or length limits on filter expressions. The vulnerable code in pkg/models/task_collection_filter.go preprocesses and recursively parses filter expressions without validating nesting depth. An authenticated attacker can submit syntactically valid filter expressions containing thousands of balanced nested parentheses (e.g., 20,000 levels) around a simple predicate like "id = 1". The recursive parser and expression-tree converter exhaust memory, killing the API process and affecting all users. The vulnerability requires authentication but is exploitable by any low-privileged user with access to a project. A patch is available in version 2.6.0.
Affected products
- Vikunja Vikunja 2.5.0 (fixed in 2.6.0)
Timeline
- 2026-08-31: disclosed: GitHub Security Advisory GHSA-xxc3-xpmc-vmvr published
- 2026-09-15: advisory: CVE-2026-91968 assigned and published to NVD
- 2026-09-15: patched: Version 2.6.0 released with fix