CVE-2026-91969: Vikunja CSV Migration DOS Vulnerability

CVE-2026-91969 Overview

CVE-2026-91969 is a resource exhaustion vulnerability in Vikunja, an open-source task management platform. Versions before 2.6.0 fail to enforce a limit on parsed row cardinality in the POST /api/v2/migration/csv/migrate endpoint. Authenticated attackers can upload multipart Comma-Separated Values (CSV) files containing millions of small records to exhaust process memory and terminate the API service. The flaw is tracked under CWE-400: Uncontrolled Resource Consumption.

Critical Impact
A single authenticated user can crash the Vikunja API through a crafted CSV upload, denying service to all tenants sharing the instance.

Affected Products

Vikunja versions prior to 2.6.0
Self-hosted Vikunja API deployments exposing the CSV migration endpoint
Multi-tenant Vikunja instances accepting authenticated user registrations

Discovery Timeline

2026-09-15 - CVE-2026-91969 published to the National Vulnerability Database (NVD)
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-91969

Vulnerability Analysis

Vikunja exposes a migration workflow that ingests CSV files describing tasks, projects, and metadata. The handler behind POST /api/v2/migration/csv/migrate parses uploaded multipart CSV payloads and constructs in-memory representations of every row before persisting them. The endpoint does not cap the number of rows processed in a single request. An authenticated attacker can therefore submit a compact CSV file containing millions of trivial records. Each parsed row allocates memory for row objects, struct fields, and intermediate slices. The process grows until the operating system kills it or Go's runtime aborts on memory pressure.

Because the request is authenticated, any user account holding migration permissions can trigger the condition. Requests exit the network path quickly, but the server-side parsing continues under load. Repeated submissions extend the outage across the whole API service, affecting every tenant on the instance.

Root Cause

The root cause is missing input validation on parsed row cardinality. The CSV migration path streams user-controlled data into an unbounded in-memory structure without enforcing a maximum record count or aggregate size. This maps directly to CWE-400: Uncontrolled Resource Consumption.

Attack Vector

Exploitation requires network access to the Vikunja API and a valid authenticated session with permission to perform migrations. The attacker crafts a small CSV file, often only a few megabytes on disk, that expands into millions of parsed row objects during ingestion. Submitting the file to the migration endpoint drives memory consumption until the API process terminates. No user interaction is required beyond the attacker's own authenticated request.

See the GitHub Security Advisory GHSA-pqf9-h8g4-8gmh and the VulnCheck Advisory on Vikunja for technical details.

Detection Methods for CVE-2026-91969

Indicators of Compromise

Unexpected POST requests to /api/v2/migration/csv/migrate with multipart CSV uploads from non-administrative accounts.
Vikunja API process crashes, OOM-killer events in system logs, or container restarts correlating with migration requests.
Sudden growth in resident memory of the Vikunja API process shortly after a migration request.
Small uploaded CSV files that decompress or parse into an unusually high row count.

Detection Strategies

Instrument the reverse proxy or API gateway to log the size, row count, and source account of every /api/v2/migration/csv/* request.
Alert when the Vikunja process is terminated by the Linux Out-Of-Memory (OOM) killer within seconds of a migration call.
Correlate authentication logs with migration endpoint access to identify low-privilege accounts abusing the workflow.

Monitoring Recommendations

Track memory and CPU utilization of the Vikunja API container and alert on sharp allocation spikes.
Monitor HTTP 5xx error rates and process restart counters for the API service.
Review audit logs for repeated migration submissions from a single user or IP address within a short window.

How to Mitigate CVE-2026-91969

Immediate Actions Required

Upgrade Vikunja to version 2.6.0 or later, which enforces bounds on CSV migration parsing.
Restrict access to the CSV migration endpoint to trusted administrators through reverse proxy access control lists.
Rotate credentials for any user account observed abusing the migration endpoint.

Patch Information

The issue is fixed in Vikunja 2.6.0. Refer to GitHub Security Advisory GHSA-pqf9-h8g4-8gmh for release details and remediation guidance. Operators running self-hosted deployments should pull the updated container image or binary and restart the API service after upgrading.

Workarounds

Block or rate-limit POST /api/v2/migration/csv/migrate at the reverse proxy until the upgrade is applied.
Enforce a strict maximum upload size for multipart requests to the migration endpoint at the ingress layer.
Disable self-service user registration on exposed instances to reduce the pool of accounts capable of reaching the endpoint.
Run the Vikunja API under a systemd or container memory limit so a single crash does not destabilize the host.

bash

# Example NGINX ingress mitigation until patching to 2.6.0
location /api/v2/migration/csv/ {
    client_max_body_size 1m;
    limit_req zone=migration_zone burst=2 nodelay;
    allow 10.0.0.0/24;   # admin subnet
    deny all;
    proxy_pass http://vikunja_api;
}