---
id: CVE-2026-91968
title: >-
  vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in
  the task-filter endpoint that accepts deeply nested filter expressions without
  recursion depth limits
summary: >-
  vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in
  the task-filter endpoint that accepts deeply nested filter expressions without
  recursion depth limits. Authenticated attackers can supply thousands of nested
  pa…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-674
vendor: go-vikunja
product: vikunja
affected:
  - vikunja >= 2.5.0 < 2.6.0
published: '2026-09-15'
updated: '2026-09-16'
sourceUpdated: '2026-09-16T20:16:09.343'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-91968'
references:
  - url: >-
      https://github.com/go-vikunja/vikunja/security/advisories/GHSA-xxc3-xpmc-vmvr
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/vikunja-before-2.6.0-denial-of-service-via-unbounded-filter-recursion
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/go-vikunja/vikunja/security/advisories/GHSA-xxc3-xpmc-vmvr
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-91968'
  - url: 'https://github.com/go-vikunja/vikunja/pull/3688'
  - url: 'https://github.com/go-vikunja/vikunja/releases/tag/v2.6.0'
  - url: 'https://github.com/advisories/GHSA-xxc3-xpmc-vmvr'
  - url: 'https://github.com/go-vikunja/vikunja'
tags:
  - nvd
  - cve.org
  - exploit-available
  - ghsa
  - go
  - osv
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-15T15:55:42.634396Z'
ingestedAt: '2026-09-15T15:39:12.914Z'
epss: 0.00436
epssPercentile: 0.37657
aliases:
  - GHSA-xxc3-xpmc-vmvr
  - GO-2026-6759
ecosystem: go
patched:
  - code.vikunja.io/api 2.6.0
---

## Overview

vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the task-filter endpoint that accepts deeply nested filter expressions without recursion depth limits. Authenticated attackers can supply thousands of nested parentheses in the filter query parameter to exhaust memory and terminate the API process.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-91968)

Affected packages:

- `code.vikunja.io/api = 2.5.0`

Patched in:

- `code.vikunja.io/api 2.6.0`

Source: https://github.com/advisories/GHSA-xxc3-xpmc-vmvr