Threats tagged 'ghsa-94xf-3vwp-m22j'

Vikunja versions prior to 2.7.1 have a denial of service vulnerability that allows authenticated users to exhaust API process memory by uploading large WeKan or vikunja-file imports without item-count limits. Attackers can submit a large (~22 MB) WeKan JSON file containing hundreds of thousands of cards or duplicate IDs to the migration endpoint, causing an out-of-memory condition and crashing the instance.