CVE-2026-33474 PUBLISHED

Vikunja Affected by DoS via Image Preview Generation

Assigner: GitHub_M
Reserved: 20.03.2026 Published: 24.03.2026 Updated: 24.03.2026

Vikunja is an open-source self-hosted task management platform. Starting in version 1.0.0-rc0 and prior to version 2.2.0, unbounded image decoding and resizing during preview generation lets an attacker exhaust CPU and memory with highly compressed but extremely large-dimension images. Version 2.2.0 patches the issue.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS Score: 6.5

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	None
Privileges Required	Low	Integrity Impact	None
User Interaction	None	Availability Impact	High

CVSS 3.1

Product Status

Vendor	go-vikunja
Product	vikunja
Versions	Version >= 1.0.0-rc0, < 2.2.0 is affected

References

https://github.com/go-vikunja/vikunja/security/advisories/GHSA-wc83-79hj-hpmq
https://vikunja.io/changelog/vikunja-v2.2.0-was-released

Problem Types

CWE-400: Uncontrolled Resource Consumption CWE