CVE-2026-91970

Vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the Planka migrator that fails to enforce aggregate memory budgets during migration jobs. Authenticated attackers can submit migration requests pointing to attacker-controlled servers advertising numerous size-compliant attachments, exhausting worker memory and causing denial of service for all users.

Vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the Planka migrator that fails to enforce aggregate memory budgets during migration jobs. Authenticated attackers can submit migration requests pointing to attacker-controlled servers advertising numerous size-compliant attachments, exhausting worker memory and causing denial of service for all users.

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-wq92-8x3r-fm38. This link is maintained to preserve external references.

Original Description

Vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the Planka migrator that fails to enforce aggregate memory budgets during migration jobs. Authenticated attackers can submit migration requests pointing to attacker-controlled servers advertising numerous size-compliant attachments, exhausting worker memory and causing denial of service for all users.

Planka migration retains an unbounded aggregate of attacker-served attachments and can OOM the API

Summary

The always-registered Planka migration lets any ordinary user select a Planka server. Although Vikunja caps each JSON response, pagination loop, and attachment independently, it has no aggregate job budget. The conversion stage downloads every advertised non-link attachment and keeps every byte slice live until the complete hierarchy is inserted. A public attacker server can therefore drive memory beyond any finite service allocation. The final Docker run preserved default SSRF policy and OOM-killed the healthy API after five individually valid 20 MiB attachment responses.

Impact and affected scope

• Type: Resource Exhaustion Dos
• Affected component: POST /api/v2/migration/planka/migrate; Asynchronous migration.requested worker for the Planka migrator
• Preconditions: A low-privilege Vikunja user supplies an attacker-operated public Planka URL and token. That server controls project/board/card/attachment counts and streams each attachment body at or below Vikunja's normal per-file limit.
• Verified revision: d66ef3d1a39c6f7289593059a1a34afd1d059260 on 28 August 2026
• Affected release range: > 2.5.0 for the tested post-2.5.0 main branch; no released build was independently reproduced

A low-privilege remote user operating a public HTTP server can terminate the shared Vikunja process and make the API unavailable with one migration submission.

Technical details

Planka conversion downloads each non-link attachment into a bytes.Buffer and assigns buf.Bytes() to the in-memory task attachment. Every allocation remains reachable in the hierarchy until all remote data has been fetched and InsertFromStructure begins. Per-response, per-page, and per-file limits do not cap the sum.

Attack path: Authenticated migration request -> synchronous attacker-server credential probe -> asynchronous Migrate with no request deadline -> fetch attacker project/board metadata -> loop attacker attachment list -> individually size-limited downloads -> retain all FileContent slices -> process/container OOM and API termination

Relevant code:

• pkg/routes/api/v2/migration_credentials.go:35
• pkg/routes/api/v2/migration_shared.go:73
• pkg/routes/api/v2/migration_shared.go:95
• pkg/modules/migration/planka/client.go:37
• pkg/modules/migration/planka/client.go:356
• pkg/modules/migration/planka/fetch.go:29
• pkg/modules/migration/planka/fetch.go:32
• pkg/modules/migration/planka/convert.go:275
• pkg/modules/migration/planka/convert.go:280
• pkg/modules/migration/planka/convert.go:293
• pkg/modules/migration/planka/planka.go:86
• pkg/modules/migration/planka/planka.go:100

Reproduction

Run this only against an authorized disposable environment. The complete verified minimum file set is reproduced below. It starts the isolated target, runs the security-relevant trigger, verifies an objective target/application signal, and exercises the available negative or sibling control.

Create reproduction/Dockerfile:

FROM golang:1.27-bookworm AS builder

WORKDIR /src
COPY --from=target . .
RUN mkdir -p frontend/dist \
    && printf '<!doctype html><title>PoC</title>' > frontend/dist/index.html \
    && go build -o /out/vikunja .

FROM golang:1.27-bookworm

RUN apt-get update \
    && apt-get install -y --no-install-recommends ca-certificates curl python3 \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /app
COPY --from=builder /out/vikunja /app/vikunja
COPY . /app
RUN chmod +x /app/verify.sh

Create reproduction/verify.sh:

#!/usr/bin/env bash
set -euo pipefail

test -d /target-repo
test "$(git -C /target-repo rev-parse HEAD)" = "d66ef3d1a39c6f7289593059a1a34afd1d059260"
test -z "${VIKUNJA_OUTGOINGREQUESTS_ALLOWNONROUTABLEIPS:-}"

mkdir -p /work/files /work/logs
export VIKUNJA_DATABASE_TYPE=sqlite
export VIKUNJA_DATABASE_PATH=/work/vikunja.db
export…

Vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the Planka migrator that fails to enforce aggregate memory budgets during migration jobs. Authenticated attackers can submit migration requests pointing to attacker-controlled servers advertising numerous size-compliant attachments, exhausting worker memory and causing denial of service for all users.

Vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the Planka migrator that fails to enforce aggregate memory budgets during migration jobs. Authenticated attackers can submit migration requests pointing to attacker-controlled servers advertising numerous size-compliant attachments, exhausting worker memory and causing denial of service for all users.

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-wq92-8x3r-fm38. This link is maintained to preserve external references.

Original Description

Vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the Planka migrator that fails to enforce aggregate memory budgets during migration jobs. Authenticated attackers can submit migration requests pointing to attacker-controlled servers advertising numerous size-compliant attachments, exhausting worker memory and causing denial of service for all users.

Planka migration retains an unbounded aggregate of attacker-served attachments and can OOM the API

Summary

The always-registered Planka migration lets any ordinary user select a Planka server. Although Vikunja caps each JSON response, pagination loop, and attachment independently, it has no aggregate job budget. The conversion stage downloads every advertised non-link attachment and keeps every byte slice live until the complete hierarchy is inserted. A public attacker server can therefore drive memory beyond any finite service allocation. The final Docker run preserved default SSRF policy and OOM-killed the healthy API after five individually valid 20 MiB attachment responses.

Impact and affected scope

• Type: Resource Exhaustion Dos
• Affected component: POST /api/v2/migration/planka/migrate; Asynchronous migration.requested worker for the Planka migrator
• Preconditions: A low-privilege Vikunja user supplies an attacker-operated public Planka URL and token. That server controls project/board/card/attachment counts and streams each attachment body at or below Vikunja's normal per-file limit.
• Verified revision: d66ef3d1a39c6f7289593059a1a34afd1d059260 on 28 August 2026
• Affected release range: > 2.5.0 for the tested post-2.5.0 main branch; no released build was independently reproduced

A low-privilege remote user operating a public HTTP server can terminate the shared Vikunja process and make the API unavailable with one migration submission.

Technical details

Planka conversion downloads each non-link attachment into a bytes.Buffer and assigns buf.Bytes() to the in-memory task attachment. Every allocation remains reachable in the hierarchy until all remote data has been fetched and InsertFromStructure begins. Per-response, per-page, and per-file limits do not cap the sum.

Attack path: Authenticated migration request -> synchronous attacker-server credential probe -> asynchronous Migrate with no request deadline -> fetch attacker project/board metadata -> loop attacker attachment list -> individually size-limited downloads -> retain all FileContent slices -> process/container OOM and API termination

Relevant code:

• pkg/routes/api/v2/migration_credentials.go:35
• pkg/routes/api/v2/migration_shared.go:73
• pkg/routes/api/v2/migration_shared.go:95
• pkg/modules/migration/planka/client.go:37
• pkg/modules/migration/planka/client.go:356
• pkg/modules/migration/planka/fetch.go:29
• pkg/modules/migration/planka/fetch.go:32
• pkg/modules/migration/planka/convert.go:275
• pkg/modules/migration/planka/convert.go:280
• pkg/modules/migration/planka/convert.go:293
• pkg/modules/migration/planka/planka.go:86
• pkg/modules/migration/planka/planka.go:100

Reproduction

Run this only against an authorized disposable environment. The complete verified minimum file set is reproduced below. It starts the isolated target, runs the security-relevant trigger, verifies an objective target/application signal, and exercises the available negative or sibling control.

Create reproduction/Dockerfile:

FROM golang:1.27-bookworm AS builder

WORKDIR /src
COPY --from=target . .
RUN mkdir -p frontend/dist \
    && printf '<!doctype html><title>PoC</title>' > frontend/dist/index.html \
    && go build -o /out/vikunja .

FROM golang:1.27-bookworm

RUN apt-get update \
    && apt-get install -y --no-install-recommends ca-certificates curl python3 \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /app
COPY --from=builder /out/vikunja /app/vikunja
COPY . /app
RUN chmod +x /app/verify.sh

Create reproduction/verify.sh:

#!/usr/bin/env bash
set -euo pipefail

test -d /target-repo
test "$(git -C /target-repo rev-parse HEAD)" = "d66ef3d1a39c6f7289593059a1a34afd1d059260"
test -z "${VIKUNJA_OUTGOINGREQUESTS_ALLOWNONROUTABLEIPS:-}"

mkdir -p /work/files /work/logs
export VIKUNJA_DATABASE_TYPE=sqlite
export VIKUNJA_DATABASE_PATH=/work/vikunja.db
export…

Vikunja: Planka migration retains an unbounded aggregate of attacker-served attachments and can OOM the API in code.vikunja.io/api.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: code.vikunja.io/api from v2.5.0 before v2.6.0.