PT-2026-31950 · Vikunja · Vikunja

Published 2026-04-10 · Updated 2026-04-10 · CVE-2026-35599

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Vikunja versions prior to 2.3.0

Description: Vikunja, a self-hosted task management platform, contains an issue where the addRepeatIntervalToTime function uses an inefficient loop. An attacker can create a repeating task with a 1-second interval and a due date far in the past, triggering billions of loop iterations. This consumes significant CPU resources and holds database connections for extended periods. The vulnerable function is located at pkg/models/tasks.go:1456-1464. The RepeatAfter field accepts any positive integer, and DueDate accepts any valid timestamp, including dates in the past. When a task with repeat after=1 and due date=1900-01-01 is marked as done, the loop runs approximately 4 billion iterations, potentially exhausting database connections. This can render the Vikunja instance unresponsive, impacting all users.

Recommendations: Upgrade to Vikunja version 2.3.0 or later.

Fix

Weakness Enumeration

CWE-407

Related Identifiers

CVE-2026-35599

GHSA-R4FG-73RC-HHH7

Affected Products

Vikunja

References · 8

• https://github.com/go-vikunja/vikunja/commit/6df0d6c8f54b01db6464c42810e40e55f12b481b · Patch
• https://github.com/go-vikunja/vikunja/security/advisories/GHSA-r4fg-73rc-hhh7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35599 · Security Note
• https://osv.dev/vulnerability/GHSA-r4fg-73rc-hhh7 · Vendor Advisory
• https://github.com/go-vikunja/vikunja/releases/tag/v2.3.0 · Note
• https://github.com/go-vikunja/vikunja · Note
• https://github.com/go-vikunja/vikunja/pull/2577 · Note
• https://twitter.com/CVEnew/status/2042710238181069091 · Twitter Post