EUVD-2026-72111
GHSA-vh7q-hj8h-q34m
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Any low-privilege authenticated user can trigger the DoS remotely with no special conditions; no confidentiality or integrity impact applies.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
5DescriptionCVE.org
wger before 2.5 fails to validate the maximum duration of routine date ranges, allowing authenticated users to create routines spanning arbitrarily long periods. Attackers can trigger the date_sequence computation via routine detail endpoints, forcing the server to iterate thousands of times per request and exhaust worker threads, denying service to legitimate users.
AnalysisAI
Uncontrolled resource consumption in wger before 2.5 allows any authenticated user to exhaust server worker threads and deny service to all legitimate users. By creating a routine with an arbitrarily long date range (e.g., 100 years spanning 2000-2099) and then triggering the unbounded date_sequence while-loop via any of five routine detail REST endpoints, a single HTTP request forces 36,525 per-day iterations - each performing O(slots × entries × configs) computation - consuming multiple seconds of CPU. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must hold a valid authenticated account on the target wger instance (CVSS PR:L); in deployments with open self-registration this requires only completing account creation. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 7.1 (AV:N/AC:L/AT:N/PR:L/UI:N/VA:H) accurately reflects the threat model. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | A fix commit (5f07a4473e2c32d298c8cdd31d78e5107840039c) exists in the wger GitHub repository and adds maximum-duration validation to the Routine model and serializer. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Implement rate limiting on the five affected routine detail REST endpoints-restrict each authenticated user to 1-2 requests per minute per endpoint and add 30-second request timeouts to prevent worker thread exhaustion. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Improper Restriction of Excessive Authentication Attempts in GitHub repository wger-project/wger prior to 2.2. Rated cri
Cross Site Scripting vulnerability in wger Project wger Workout Manager v.2.2.0a3 allows a remote attacker to gain privi
Cross Site Request Forgery (CSRF) vulnerability in wger Project wger Workout Manager 2.2.0a3 allows a remote attacker to
Wger versions up to 2.4 allow authenticated users to access other users' private nutrition plans through insecure direct
Wger versions up to 2.4 expose all users' repetition configuration data to any authenticated attacker due to missing aut
wger is a free, open-source workout and fitness manager. Five routine detail action endpoints check a cache before calli
Incomplete authorization fix in wger through master exposes three user-management views in wger/core/views/user.py to th
Cross-site request forgery in wger's gym password-reset endpoint allows a remote attacker to force an arbitrary member's
Open redirect in wger's trainer_login view allows an attacker to redirect an authenticated trainer's browser to an arbit
CSV/TSV formula injection in wger's gym member export endpoint allows any authenticated gym member to pre-load spreadshe
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today