CVE-2026-91968

Executive Summary

CVE-2026-91968 is a resource exhaustion vulnerability (CWE-674, uncontrolled recursion) in the Vikunja task-management application affecting all versions prior to 2.6.0. The task-filter endpoint accepts filter expressions containing deeply nested parentheses without enforcing a recursion depth limit, allowing any authenticated user to submit thousands of nested parentheses via the filter query parameter and exhaust server memory, terminating the API process. With a CVSS v3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), the flaw is a low-complexity, authenticated denial-of-service condition that degrades availability of the Vikunja instance for all users.

Technical Analysis

The vulnerability resides in Vikunja's task-filter functionality. Vikunja exposes a filter query parameter that accepts structured filter expressions — expressions that are parsed, and that support parenthetical grouping (nesting). The NVD description states the endpoint "accepts deeply nested filter expressions without recursion depth limits." Because the parser recurses once per nesting level, each opening parenthesis increases the call-stack depth and, depending on implementation, allocates intermediate parse tree or token objects. An attacker supplies "thousands of nested parentheses," causing unbounded recursion and memory consumption.

Two failure outcomes are consistent with the description and CWE-674:

1. Memory exhaustion — the process accumulates parse-tree/stack objects faster than they are freed, driving the API process to consume available memory.
2. Stack exhaustion / recursion-induced termination — unbounded recursion depth can overflow the process stack.

Either path results in the API process terminating, which per the description is the observed impact ("exhaust memory and terminate the API process"). This maps directly to CWE-674 (Uncontrolled Recursion) and to the CVSS impact vector A:H (High availability impact) with no confidentiality or integrity impact (C:N/I:N/A:H).

Key characteristics derived strictly from the provided data:

• Attack vector: Network (AV:N) — the endpoint is reachable over HTTP(S).
• Privileges required: Low (PR:L) — the attacker must be authenticated ("Authenticated attackers").
• User interaction: None (UI:N).
• Scope: Unchanged (S:U) — only the Vikunja component is affected.
• Complexity: Low (AC:L) — the attack requires only crafting a string of nested parentheses.

The parsing logic is confined to the task-filter endpoint's filter query parameter. No other endpoints, functions, classes, or parameters are identified in the source data, and none are asserted here. The exact parser library and the precise recursion frame are not disclosed in the NVD description; the mechanism is therefore described at the vulnerability-class level.

Exploitation Scenarios

No public PoC, Nuclei template, or exploit code is known (POC_STATUS: None; Exploit Code: NO). The following chain is inferred from the vulnerability class (uncontrolled recursion / resource exhaustion) and the NVD description, and deliberately avoids inventing implementation-specific names.

1. Reconnaissance / target identification The attacker identifies a reachable Vikunja instance (typically an internal task-management deployment, often exposed on a web interface). The attacker registers or obtains a valid low-privileged account, confirming the target is running a version prior to 2.6.0. Because the flaw is server-side and version-based, no special network position is required beyond HTTP(S) reachability.

2. Triggering the flaw class The attacker constructs a request to the task-filter endpoint with a filter query parameter whose value is a filter expression containing a very large number of unmatched or matched nested parentheses (e.g., thousands of "(" characters). Because the endpoint performs recursive parsing with no depth limit, each parenthesis adds a recursion level, and the parser consumes memory (and/or stack) proportional to the nesting depth.

3. Execution method (vulnerability-class level) The request is submitted as an ordinary authenticated HTTP request through the filter query parameter. No code execution, injection payload, or malformed exploit primitive is required — the payload is simply an oversized, deeply nested filter expression. Because no depth or size limit is enforced, the server processes the expression eagerly.

4. Post-exploitation impact As the parser recurses, memory is exhausted and the API process terminates. Depending on the deployment (container, systemd service, process manager), the API may restart automatically, but repeated requests produce a sustained denial of service: legitimate users cannot load tasks or use the application. No data theft or modification is associated with this CVE (C:N/I:N), so the impact is availability-only.

Note: The attack chain is at the vulnerability-class level; no specific function names, parser internals, or exact payload syntax are asserted beyond the filter query parameter and nested parentheses explicitly described by NVD.

Impact Assessment

• Business impact: Denial of service against the Vikunja task-management platform. Teams relying on Vikunja for task tracking lose access during the outage window. Repeated exploitation creates a persistent availability problem that can block work management, planning, and reporting workflows.
• Affected systems: Any Vikunja instance running a version prior to 2.6.0 that exposes the task-filter endpoint to authenticated users.
• Blast radius: Because the flaw terminates the API process, all users of the affected instance are impacted at once, not just the attacker. In containerized or auto-restarting deployments, the effect is intermittent but recurring; in manually supervised deployments, downtime may be prolonged until an operator restarts the service.
• CVSS subscores: AV:N (remote), AC:L (trivial to craft), PR:L (authenticated), UI:N (no user action), S:U (contained), C:N (no confidentiality loss), I:N (no integrity loss), A:H (high availability impact). Base score 6.5 (Medium).
• EPSS: 0.00368 (≈30.4th percentile), indicating low near-term exploitation likelihood relative to other CVEs, consistent with an authenticated-only availability bug and no public exploit.
• CISA KEV: Not listed — no confirmed exploitation in the wild.

Detection Guidance

Sigma Rule

title: Vikunja Task-Filter Deep Recursion Denial of Service Attempt
id: 3f9a2c17-6b4e-4c8a-9d21-5e7b0a1c2d34
status: experimental
description: Detects HTTP requests to the Vikunja task-filter endpoint containing abnormally deep nested parentheses in the filter query parameter, indicative of CVE-2026-91968 resource exhaustion attempts.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-91968
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-uri-query|contains:
      - 'filter='
  selection_nesting:
    cs-uri-query|re: '\\({20,}'
  condition: selection_endpoint and selection_nesting
fields:
  - c-ip
  - cs-uri-stem
  - cs-uri-query
  - sc-status
falsepositives:
  - Legitimate complex filter expressions (rare; threshold of 20+ consecutive parentheses is well above normal use)
level: medium
tags:
  - attack.t1499
  - cve.2026-91968

YARA Rule

rule CVE_2026_91968_Vikunja_Filter_Recursion_DoS
{
    meta:
        description = "Detects HTTP requests containing deeply nested parentheses in a Vikunja filter parameter, indicative of CVE-2026-91968 recursion-based resource exhaustion"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-91968"
        date = "2026-01-01"
        cve = "CVE-2026-91968"

    strings:
        $filter = "filter=" ascii nocase
        $nest1  = "((((((((((((((((((" ascii
        $nest2  = "))))))))))))))))))" ascii

    condition:
        $filter and (any of ($nest*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-91968 Vikunja Task-Filter Deep Recursion DoS Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"filter="; pcre:"/filter=[^&]*\\({20,}/Ui"; threshold:type both, track by_src, count 3, seconds 60; classtype:attempted-dos; reference:cve,2026-91968; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-91968; sid:202691968; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=1m
  [ network where network.protocol == "http" and url.query : "filter=*" ]
  [ network where network.protocol == "http" and url.query regex~ "filter=.*\\({20,}" ]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=nginx:plus:access
| eval filter_depth = len(mvindex(split(uri_query, "(") , 0))
| where match(uri_query, "filter=") AND len(uri_query) > 500
| rex field=uri_query max_match=0 "(?<paren>\()"
| stats count AS open_parens by src_ip, uri_path, uri_query
| where open_parens >= 20
| table _time src_ip uri_path open_parens uri_query
| sort - open_parens

Wazuh OSSEC Rule

<group name="web,vikunja,cve-2026-91968,">
  <rule id="100968" level="10">
    <if_sid>31100</if_sid>
    <id>^GET</id>
    <match>filter=</match>
    <regex>filter=[^&]*\({20,}</regex>
    <description>CVE-2026-91968: Possible Vikunja task-filter recursion denial-of-service attempt (deeply nested parentheses)</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>attack.t1499,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch (not independently confirmed); source: OSV).

1. Immediate mitigations (if upgrade cannot be performed at once):

   • Restrict network access to the Vikunja API/web interface to trusted networks or via VPN; require authentication for all filter functionality.
   • Deploy a reverse proxy (nginx, HAProxy, or similar WAF) in front of Vikunja and cap request URI/query length, and reject filter query values exceeding a sane nesting/length threshold (e.g., reject more than a small fixed number of consecutive parentheses). The signatures provided above can be translated into proxy rules.
   • Enable aggressive process supervision/restart (systemd restart-on-failure, container liveness probes) to shorten outage windows, while recognizing this only limits — not eliminates — the DoS.
   • Monitor and rate-limit authenticated users hitting the task-filter endpoint with unusually large query strings.

2. Patch / upgrade steps:

   • Upgrade Vikunja to version 2.6.0 or later, which per the single-source OSV record contains the fix (recursion depth limiting in the filter parser). Validate in a staging environment before production rollout.
   • Confirm the running version after upgrade and re-test the task-filter endpoint with a benign nested filter to confirm normal operation.
   • Because patch confidence is only 2/4 and the fix is single-source, independently verify the changelog/release notes for the recursion-depth fix before treating the issue as fully resolved.

3. Long-term hardening:

   • Enforce recursion depth and input size limits on all parser entry points, and treat parser depth exhaustion (CWE-674) as a class-level remediation item.
   • Add fuzz testing for the filter expression parser, including deep-nesting cases.
   • Implement application-level rate limiting and request size limits.
   • Maintain an asset inventory of Vikunja deployments and subscribe to vendor release feeds to shorten exposure windows for future parser-related issues.

References

• NVD — CVE-2026-91968: https://nvd.nist.gov/vuln/detail/CVE-2026-91968
• CWE-674 — Uncontrolled Recursion: https://cwe.mitre.org/data/definitions/674.html
• OSV — Vikunja advisory record (single-source patch claim for 2.6.0)
• FIRST EPSS — score lookup for CVE-2026-91968: https://api.first.org/data/v1/epss?cve=CVE-2026-91968
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-91968 not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-91968 as of this report. EPSS 0.00368 (≈30.4th percentile) and the absence of public PoC, Nuclei template, or KEV listing indicate low current exploitation activity.