CVE-2026-123523 Vikunja before 2.7.1 Memory Exhaustion via Unbounded Avatar Size Cache
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-123523?
CVE-2026-123523 is a high-severity vulnerability in go-vikunja vikunja, published on 8 Nov 2026.
Official description
Vikunja before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated users to exhaust server memory by requesting avatars at many distinct sizes. Attackers can upload a noisy avatar and fetch it at each size up to 1024, caching roughly a gigabyte per account without eviction and causing the API process to be OOM-killed.
Weakness: CWE-770
Which versions are affected by CVE-2026-123523?
How do I fix CVE-2026-123523?
No fix has been published for CVE-2026-123523 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-123523 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-123523 exists.
Sources
Also known as GHSA-3x3m-2j93-w46j, GHSA-w5pw-69q7-rf8x.