CVE-2026-123501 Vikunja before 2.7.1 Memory Exhaustion DoS via Unbounded Image Decodes
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-123501?
CVE-2026-123501 is a high-severity vulnerability in go-vikunja vikunja, published on 8 Nov 2026.
Official description
Vikunja before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated users to exhaust server memory through concurrent image decodes in avatar and background uploads. Attackers can send several parallel tiny, highly compressible PNGs decoded at up to 50 megapixels each, pushing the API process into memory pressure or an OOM kill.
Weakness: CWE-400
Which versions are affected by CVE-2026-123501?
How do I fix CVE-2026-123501?
No fix has been published for CVE-2026-123501 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-123501 being exploited?
There is no known exploitation of CVE-2026-123501 in the wild and no public exploit code.
Sources
Also known as GHSA-9hxw-pxcq-4q8q, GHSA-qgpv-qrrx-2qgv.