CyberRota Analysis
AI-GeneratedVikunja versions prior to 2.6.0 are susceptible to a resource exhaustion vulnerability in the task-filter endpoint, allowing authenticated attackers to submit deeply nested filter expressions that can consume excessive memory and crash the API process. Organizations using affected versions should prioritize patching to mitigate the risk of service disruption and potential denial-of-service attacks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the task-filter endpoint that accepts deeply nested filter expressions without recursion depth limits. Authenticated attackers can supply thousands of nested parentheses in the filter query parameter to exhaust memory and terminate the API process.