CVE-2026-91971: Vikunja Image Processing DOS Vulnerability

CVE-2026-91971 Overview

CVE-2026-91971 is a denial of service vulnerability in Vikunja, an open-source task management application, affecting all versions before 2.6.0. The flaw resides in the avatar and project-background upload endpoints, which fail to enforce pixel decode limits on user-supplied images. Authenticated users can submit crafted image files that decode to excessive pixel counts, consuming substantial CPU and memory during server-side processing. Repeated or concurrent uploads amplify resource consumption and can render the service unavailable to legitimate users. The vulnerability is tracked under [CWE-400: Uncontrolled Resource Consumption] and documented in GitHub Security Advisory GHSA-4vh2-39rq-rq8j.

Critical Impact
Authenticated attackers can exhaust server CPU and memory by uploading small image files with extreme aspect ratios, causing denial of service for all Vikunja users.

Affected Products

Vikunja versions prior to 2.6.0
Avatar upload endpoint
Project-background upload endpoint

Discovery Timeline

2026-09-15 - CVE-2026-91971 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-91971

Vulnerability Analysis

The vulnerability affects Vikunja's image processing pipeline for user-uploaded avatars and project backgrounds. When a client submits an image, the server decodes the file to inspect and resize it before storage. Vikunja before 2.6.0 validates the raw file size but does not cap the total decoded pixel count.

An image with dimensions such as 1x1,000,000,000 pixels compresses to a small file but expands into a very large in-memory bitmap during decode. Each pixel requires several bytes of allocation, and the decode operation runs on the server's main worker pool. A single request can consume gigabytes of RAM and saturate CPU cycles.

Concurrent uploads by one or more authenticated accounts multiply the resource pressure. Worker threads block on allocation and garbage collection, and the process may be terminated by the operating system's out-of-memory killer. Full technical context is available in the VulnCheck Advisory on Vikunja DoS.

Root Cause

The root cause is missing input validation on decoded image dimensions. The upload handlers accept any image whose byte length falls under the configured file-size limit. They do not compare width times height against a maximum pixel threshold before invoking the decoder.

Attack Vector

Exploitation requires an authenticated Vikunja account with permission to update a user profile or project background. The attacker crafts a compressed image such as a PNG or GIF with an extreme aspect ratio and small on-disk size. The attacker then submits the file to the avatar or project-background endpoint over HTTPS, optionally repeating the request in parallel to accelerate resource exhaustion.

The vulnerability manifests inside the image decode routine. See the linked GitHub Security Advisory and VulnCheck advisory for technical details and the upstream fix.

Detection Methods for CVE-2026-91971

Indicators of Compromise

Sudden spikes in CPU or memory usage on the Vikunja server correlated with POST requests to avatar or project-background upload endpoints.
Out-of-memory events, worker crashes, or systemd restarts on the Vikunja process.
Repeated multipart uploads from a single authenticated session within a short window.
Requests carrying image files with unusually small byte counts but reported dimensions in the millions of pixels.

Detection Strategies

Inspect reverse proxy or web application firewall logs for high-frequency uploads to /api/v1/user/settings/avatar/upload and project-background routes.
Correlate image upload requests with process-level resource metrics to flag anomalous CPU or memory bursts.
Enable application-level logging that records decoded image dimensions and reject entries exceeding sane thresholds.

Monitoring Recommendations

Track the ratio of upload request count to server memory consumption per authenticated user.
Alert on any Vikunja worker process exceeding a memory baseline defined for the deployment.
Monitor upstream service health checks for latency degradation coincident with upload traffic.

How to Mitigate CVE-2026-91971

Immediate Actions Required

Upgrade Vikunja to version 2.6.0 or later, which enforces pixel decode limits on both affected endpoints.
Audit existing user accounts and revoke access for untrusted or dormant identities that could abuse upload functionality.
Place Vikunja behind a reverse proxy that enforces per-user request rate limits on upload paths.

Patch Information

The Vikunja maintainers released version 2.6.0 to remediate CVE-2026-91971. The fix applies pixel count limits during image decode on the avatar and project-background upload endpoints. Upgrade instructions and release notes are published in the GitHub Security Advisory GHSA-4vh2-39rq-rq8j.

Workarounds

Restrict maximum request body size at the reverse proxy to a value well below typical avatar file sizes.
Apply strict rate limiting on POST requests to avatar and project-background endpoints, keyed by authenticated user identifier.
Disable avatar and project-background uploads for untrusted users until the patched release is deployed.
Run the Vikunja process under cgroup memory limits so a single decode operation cannot exhaust host resources.

bash

# Example nginx rate limit for Vikunja upload endpoints
limit_req_zone $binary_remote_addr zone=vikunja_uploads:10m rate=5r/m;

location ~ ^/api/v1/(user/settings/avatar/upload|projects/[0-9]+/background) {
    limit_req zone=vikunja_uploads burst=2 nodelay;
    client_max_body_size 512k;
    proxy_pass http://vikunja_backend;
}