CVE-2026-86255: Uncontrolled Resource Consumption in wger-project wger

The wger application prior to version 2.5 does not properly validate the maximum duration of routine date ranges. Authenticated attackers can exploit this by creating routines that span very long periods. When the server processes these routines via the routine detail endpoints, it triggers a date_sequence computation that iterates thousands of times per request. This excessive iteration exhausts server worker threads, resulting in denial of service to legitimate users.

Successful exploitation allows an authenticated user to cause denial of service by exhausting server worker threads through uncontrolled resource consumption. This disrupts availability of the wger service for legitimate users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user permissions to prevent creation of routines with excessively long date ranges if possible.