Threats tagged 'ghsa-5gjc-rq8x-g8fj'

Vikunja versions prior to 2.7.1 have a resource exhaustion vulnerability in the vikunja-file ZIP importer. Authenticated users can exploit this by uploading ZIP archives with excessive entries, including many empty or non-file entries that bypass per-entry limits. This causes the scanArchive function to process entries twice, leading to high CPU and memory consumption and potential denial of service.