CVE-2026-91970
MEDIUM
NVD
CVSS Score
6.5
Severity
MEDIUM
Published
Sep 15, 2026
Vendor
unknown
Description
Vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the Planka migrator that fails to enforce aggregate memory budgets during migration jobs. Authenticated attackers can submit migration requests pointing to attacker-controlled servers advertising numerous size-compliant attachments, exhausting worker memory and causing denial of service for all users.