CVE-2026-35599

Katalog CVE

CVSS 6.5 · Medium EPSS 0,58%

Kerentanan Inefficient Algorithmic Complexity pada vikunja. Skor CVSS 3.1 6.5 (Medium) menurut github.com.

Deskripsi (NVD)

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the addRepeatIntervalToTime function uses an O(n) loop that advances a date by the task's RepeatAfter duration until it exceeds the current time. By creating a repeating task with a 1-second interval and a due date far in the past, an attacker triggers billions of loop iterations, consuming CPU and holding a database connection for minutes per request. This vulnerability is fixed in 2.3.0.

Rincian

Terbit di NVD

10 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-407: Inefficient Algorithmic Complexity

EPSS (30 hari)

0,58% peluang dieksploitasi; lebih tinggi dari 46,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/go-vikunja/vikunja/security/advisories/GHSA-r4fg-73rc-hhh7 exploit · advisory vendor
• https://github.com/go-vikunja/vikunja/commit/6df0d6c8f54b01db6464c42810e40e55f12b481b patch
• https://github.com/go-vikunja/vikunja/pull/2577 issue tracking
• https://github.com/go-vikunja/vikunja/releases/tag/v2.3.0 release notes