CyberRota Analysis
AI-GeneratedVikunja versions prior to 2.6.0 are vulnerable to a resource exhaustion issue in the Planka migrator, which does not enforce memory limits during migration tasks. This allows authenticated attackers to exploit the vulnerability by submitting migration requests to malicious servers, potentially leading to denial of service for all users by exhausting system memory. Organizations using affected versions should prioritize upgrading to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the Planka migrator that fails to enforce aggregate memory budgets during migration jobs. Authenticated attackers can submit migration requests pointing to attacker-controlled servers advertising numerous size-compliant attachments, exhausting worker memory and causing denial of service for all users.