Duplicate Advisory: Vikunja: Unbounded nested task-filter recursion permits API process termination

The vulnerability in Vikunja (code.vikunja.io/api) affects version 2.5.0 and earlier, where the task-filter endpoint accepts filter query parameters with deeply nested parentheses without recursion depth limits. Authenticated attackers can exploit this by supplying thousands of nested parentheses, leading to resource exhaustion (memory) and causing the API process to terminate unexpectedly. This is classified under CWE-674 (Improper Control of a Resource Through its Lifetime). The CVSS 3.1 base score is 6.5, indicating a high severity impact primarily due to availability disruption. The advisory is marked as a duplicate and withdrawn, referencing GHSA-xxc3-xpmc-vmvr for the original report.

An authenticated attacker can cause a denial of service by exhausting memory resources through deeply nested filter expressions in the task-filter API endpoint, resulting in termination of the API process and loss of availability. There is no impact on confidentiality or integrity according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory GHSA-xxc3-xpmc-vmvr for current remediation guidance. Since this advisory is a duplicate and withdrawn, refer to the original advisory for official fixes or mitigation steps.