What is GHSA-jfw3-2gcf-23r5?

GHSA-jfw3-2gcf-23r5 is a security advisory published by GitHub Security Advisories with High severity. vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the task-filter...

Which CVE IDs does GHSA-jfw3-2gcf-23r5 cover?

GHSA-jfw3-2gcf-23r5 covers the following CVE IDs: CVE-2026-91968. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-jfw3-2gcf-23r5?

GHSA-jfw3-2gcf-23r5 has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

GHSA-jfw3-2gcf-23r5HighCVSS 6.5

vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the task-filter...

Vendor

GitHub Security Advisories

Published

September 15, 2026

Last Modified

September 15, 2026

🔗 CVE IDs covered (1)

CVE-2026-91968 →

📋 Description

vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the task-filter endpoint that accepts deeply nested filter expressions without recursion depth limits. Authenticated attackers can supply thousands of nested parentheses in the filter query parameter to exhaust memory and terminate the API process.

🔗 References (4)

https://github.com/go-vikunja/vikunja/security/advisories/GHSA-xxc3-xpmc-vmvr
https://nvd.nist.gov/vuln/detail/CVE-2026-91968
https://www.vulncheck.com/advisories/vikunja-before-2.6.0-denial-of-service-via-unbounded-filter-recursion
https://github.com/advisories/GHSA-jfw3-2gcf-23r5