CVE-2026-123516 Vikunja before 2.7.1 Resource Exhaustion via Vikunja-File ZIP Import
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-123516?
CVE-2026-123516 is a high-severity vulnerability in go-vikunja vikunja, published on 8 Nov 2026.
Official description
Vikunja before 2.7.1 contains a resource exhaustion vulnerability in the vikunja-file ZIP importer that allows authenticated users to consume CPU and memory by uploading archives with excessive entries. Attackers can upload export ZIPs containing many empty or non-files/ entries that bypass the per-entry caps, forcing scanArchive to process every entry twice.
Weakness: CWE-770
Which versions are affected by CVE-2026-123516?
How do I fix CVE-2026-123516?
No fix has been published for CVE-2026-123516 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-123516 being exploited?
There is no known exploitation of CVE-2026-123516 in the wild and no public exploit code.
Sources
Also known as GHSA-5gjc-rq8x-g8fj, GHSA-mqq8-869v-48q8.