CVE-2026-91968: Vikunja Task-Filter DoS Vulnerability

CVE-2026-91968 Overview

CVE-2026-91968 is a resource exhaustion vulnerability affecting Vikunja versions before 2.6.0. The flaw resides in the task-filter endpoint, which parses filter expressions supplied through the filter query parameter without enforcing recursion depth limits. Authenticated attackers can submit thousands of nested parentheses to exhaust process memory and terminate the API service. The weakness maps to CWE-674: Uncontrolled Recursion and results in denial of service against the availability of the Vikunja backend. Because the endpoint requires only low-privilege authentication, any registered user can trigger the outage.

Critical Impact
Any authenticated user can crash the Vikunja API process with a single crafted filter query, denying task management services to the entire tenant.

Affected Products

Vikunja versions prior to 2.6.0
Vikunja task-filter API endpoint (filter query parameter)
Self-hosted Vikunja deployments exposing the REST API to authenticated users

Discovery Timeline

2026-09-15 - CVE-2026-91968 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-91968

Vulnerability Analysis

Vikunja is an open-source task and project management application written in Go. The API supports advanced task filtering through a query language accepted by the task-filter endpoint. The parser processes grouped sub-expressions delimited by parentheses to allow boolean composition of filter clauses.

The parser recurses into each nested group without tracking or capping the descent depth. When an authenticated attacker supplies a filter value containing thousands of nested parentheses, the parser allocates stack frames and intermediate expression objects for every level. Memory consumption grows linearly with input depth until the Go runtime exhausts available memory and terminates the API process. Restart storms follow if a supervisor repeatedly relaunches the crashed process against the same request pattern.

Root Cause

The root cause is missing input validation on structural complexity in the filter expression parser. The implementation validates individual token syntax but does not enforce a maximum nesting depth or a maximum expression tree size. Uncontrolled recursion of this class is tracked as CWE-674 and is a common failure mode in hand-written recursive-descent parsers that trust client-supplied input.

Attack Vector

Exploitation requires network access to the API and valid credentials with permission to invoke the task-filter endpoint. The attacker issues a single HTTP request in which the filter query parameter contains a long sequence of nested parentheses. Delivery does not require user interaction, and the request payload is small relative to the memory it forces the server to allocate. Refer to the GitHub Security Advisory GHSA-xxc3-xpmc-vmvr and the VulnCheck Vikunja DoS Advisory for the vendor-confirmed exploitation pattern.

Detection Methods for CVE-2026-91968

Indicators of Compromise

HTTP requests to task-filter endpoints containing filter query parameters with abnormally long runs of ( and ) characters.
Vikunja API process crashes or out-of-memory (OOM) kills recorded in system logs shortly after receiving filter requests.
Spikes in resident memory usage of the Vikunja binary correlated with API request bursts from a single authenticated session.

Detection Strategies

Inspect reverse proxy or WAF logs for filter parameters whose length or parenthesis count exceeds a reasonable threshold, for example more than 100 nested groups.
Alert on repeated 5xx responses or connection resets from the Vikunja API immediately following requests to task listing endpoints.
Correlate authenticated user session IDs with API crashes to identify the source account abusing the endpoint.

Monitoring Recommendations

Enable process-level memory and restart monitoring on the Vikunja API service to detect resource exhaustion events.
Forward reverse proxy access logs to a centralized log platform and retain the full request URI for post-incident analysis.
Track authentication and API request telemetry per user to surface accounts issuing anomalous filter query volumes.

How to Mitigate CVE-2026-91968

Immediate Actions Required

Upgrade Vikunja to version 2.6.0 or later on all backend instances.
Rotate credentials for any accounts observed sending malformed filter requests during triage.
Restrict API access to trusted networks where feasible until patching completes.

Patch Information

The Vikunja maintainers addressed the vulnerability in version 2.6.0 by enforcing a recursion depth limit in the filter expression parser. Administrators should update the vikunja binary or container image to >= 2.6.0 and restart the API service. Release details are documented in the GitHub Security Advisory GHSA-xxc3-xpmc-vmvr.

Workarounds

Deploy a reverse proxy or WAF rule that rejects requests where the filter query parameter exceeds a fixed length or nesting depth.
Apply per-user rate limits on task-filter endpoints to reduce the blast radius of abusive requests.
Run the Vikunja API under a process supervisor with strict memory limits so that OOM events do not cascade into host-level instability.

bash

# Example nginx rule rejecting oversized filter query parameters
if ($arg_filter ~* "\({50,}") {
    return 400;
}