Vikunja versions prior to 2.6.0 contain an uncontrolled resource consumption vulnerability during the data import process. The software fails to impose limits on archive expansion, allowing authenticated attackers to upload compressed files that decompress into very large sizes, consuming excessive memory and disk space. This results in denial of service conditions by exhausting server resources and causing application crashes. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level with network attack vector, low attack complexity, requiring privileges, no user interaction, and causing availability impact only.

Exploitation of this vulnerability allows authenticated users to cause denial of service by exhausting server memory and disk resources through oversized archive expansion during data import. This leads to application crashes and service unavailability. There is no impact on confidentiality or integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict or monitor authenticated user uploads to prevent large or suspicious archive files that could trigger resource exhaustion.