Duplicate Advisory: Vikunja: Planka migration retains an unbounded aggregate of attacker-served attachments and can OOM the API

Vikunja before version 2.6.0 contains a resource exhaustion vulnerability (CWE-770) in its Planka migration component. The migrator does not enforce aggregate memory limits during migration jobs, allowing authenticated attackers to submit migration requests referencing attacker-controlled servers with numerous attachments. These attachments, while individually size-compliant, collectively exhaust worker memory, causing denial of service by crashing or incapacitating the API service.

The vulnerability allows authenticated attackers to cause denial of service by exhausting memory resources of the API service during migration operations. There is no impact on confidentiality or integrity reported. Availability is severely affected due to potential out-of-memory conditions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this advisory is a duplicate and withdrawn, refer to the original advisory GHSA-wq92-8x3r-fm38 for updates on fixes or mitigations. Until a fix is applied, restrict authenticated user permissions to prevent unauthorized migration requests or monitor for abnormal migration activity.