Duplicate Advisory: Vikunja: Unbounded CSV row cardinality permits API process termination

Vikunja prior to version 2.6.0 contains a resource exhaustion vulnerability in the CSV migration API endpoint. The endpoint does not limit the number of parsed CSV rows, enabling an authenticated attacker to submit multipart CSV files with millions of small records. This can lead to excessive memory consumption and termination of the API process, resulting in denial of service. The vulnerability has a CVSS 3.1 score of 6.5 (High) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. There is no indication of known exploits in the wild. This advisory is a duplicate and has been withdrawn in favor of GHSA-pqf9-h8g4-8gmh.

An authenticated attacker can cause denial of service by exhausting the API process memory through uploading large CSV files with many tiny records. This leads to termination of the API service, impacting availability. There is no confidentiality or integrity impact reported.

Patch status is not yet confirmed — check the vendor advisory GHSA-pqf9-h8g4-8gmh for current remediation guidance. Since this advisory is a duplicate and withdrawn, refer to the original advisory for official fixes or mitigations. No temporary or official fix information is provided here.