https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-12T04:23:07.770531+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-91970 fkie_cve-2026-91970 2026-10-12T04:23:07.789997+00:00

Vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the Planka migrator that fails to enforce aggregate memory budgets during migration jobs. Authenticated attackers can submit migration requests pointing to attacker-controlled servers advertising numerous size-compliant attachments, exhausting worker memory and causing denial of service for all users.

 https://db.gcve.eu/vuln/ghsa-c2g7-39fr-cp8q Withdrawn: GHSA-c2g7-39fr-cp8q — Duplicate Advisory: Vikunja: Planka migration retains an unbounded aggregate of attacker-served attachments and can OOM… 2026-10-12T04:23:07.790067+00:00

Withdrawn by the publisher.

Affected: Go: code.vikunja.io/api

### Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-wq92-8x3r-fm38. This link is maintained to preserve external references.

### Original Description Vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the Planka migrator that fails to enforce aggregate memory budgets during migration jobs. Authenticated attackers can submit migration requests pointing to attacker-controlled servers advertising numerous size-compliant attachments, exhausting worker memory and causing denial of service for all users.