CVE-2026-86255: wger Workout Manager DoS Vulnerability

CVE-2026-86255 Overview

CVE-2026-86255 is an uncontrolled resource consumption vulnerability in wger, an open-source fitness and workout tracker, affecting versions prior to 2.5. The application fails to validate the maximum duration of routine date ranges. Authenticated users can create routines that span arbitrarily long time periods. When the routine detail endpoints are queried, the server invokes the date_sequence computation, iterating thousands of times per request. This behavior exhausts worker threads and denies service to legitimate users. The flaw is classified under CWE-400: Uncontrolled Resource Consumption.

Critical Impact
Authenticated attackers can exhaust server worker threads with a single crafted routine, rendering the wger instance unavailable to legitimate users.

Affected Products

wger fitness tracker versions prior to 2.5
Self-hosted wger deployments exposing routine detail endpoints
Multi-tenant wger instances allowing user-created routines

Discovery Timeline

2026-09-06 - CVE-2026-86255 published to the National Vulnerability Database
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86255

Vulnerability Analysis

The vulnerability resides in wger's routine handling logic. Routines in wger are training plans defined by a start date and an end date. The server computes a date_sequence for each routine, iterating day by day across the defined range to produce the schedule returned by routine detail endpoints.

The application does not enforce an upper bound on the length of the date range. Any authenticated user with permission to create a routine can define a range spanning years, decades, or longer. Each subsequent request to the routine detail endpoint triggers a full iteration across every day in the range. The iteration is synchronous and blocks the handling worker thread until it completes.

Because the request is inexpensive to send but expensive to serve, a small number of concurrent requests can occupy every available worker thread. Legitimate users then receive timeouts or errors while the workers process the malicious computations. Refer to the GitHub Security Advisory GHSA-v25j-wqcw-fvhj for maintainer commentary.

Root Cause

The root cause is missing input validation on the maximum permissible duration of a routine. The date_sequence computation trusts caller-supplied date boundaries and iterates unbounded. This is a classic algorithmic complexity issue where per-request work scales linearly with attacker-controlled input.

Attack Vector

Exploitation requires authenticated access with routine creation privileges. On wger instances that permit self-service registration, this precondition is trivial to satisfy. The attacker creates one or more routines with extreme date ranges, then repeatedly requests the routine detail endpoint. Each request consumes a worker thread for the duration of the iteration, degrading or fully denying service to other users. See the VulnCheck Advisory on wger for additional context.

No verified proof-of-concept code has been published. The exploitation pattern follows a standard resource-exhaustion primitive against a synchronous computation endpoint.

Detection Methods for CVE-2026-86255

Indicators of Compromise

Routines in the wger database with start and end dates spanning years or longer
Sustained CPU saturation on wger application workers correlated with routine detail endpoint traffic
Elevated latency or HTTP 5xx errors on /api/v2/routine/ and related detail endpoints
Repeated requests from a single authenticated principal to the same routine detail endpoint

Detection Strategies

Audit the routine data model for entries whose end date exceeds a reasonable training horizon such as 12 months
Instrument the date_sequence computation with per-request timing and log entries above a defined threshold
Correlate authentication logs with slow-request logs to identify accounts issuing repeated expensive queries

Monitoring Recommendations

Track worker thread utilization and queue depth on the wger application server
Alert on request duration percentiles for routine detail endpoints exceeding baseline
Monitor account creation velocity on instances that allow self-service registration
Capture web server access logs with response times and account identifiers for post-incident analysis

How to Mitigate CVE-2026-86255

Immediate Actions Required

Upgrade wger to version 2.5 or later, which enforces validation on routine date ranges
Review existing routines and remove or truncate entries with unreasonably long date ranges
Restrict routine creation on public-facing instances until the upgrade is applied
Apply per-user request rate limiting to routine detail endpoints

Patch Information

The issue is fixed in wger 2.5. Operators should upgrade to the latest release documented in the GitHub Security Advisory GHSA-v25j-wqcw-fvhj. After upgrading, verify that the validation on routine duration is active by attempting to create a routine with an oversized range and confirming that the server rejects it.

Workarounds

Place wger behind a reverse proxy that enforces per-endpoint rate limits and request timeouts
Reduce the worker request timeout so runaway date_sequence computations are terminated before exhausting the pool
Disable self-service registration to raise the barrier for anonymous exploitation
Add a database-level constraint or application middleware that rejects routines exceeding a defined maximum duration

bash

# Example reverse-proxy rate limit and timeout (nginx)
limit_req_zone $binary_remote_addr zone=wger_detail:10m rate=10r/m;

location /api/v2/routine/ {
    limit_req zone=wger_detail burst=5 nodelay;
    proxy_read_timeout 10s;
    proxy_pass http://wger_upstream;
}