CVE-2026-91979

Executive Summary

CVE-2026-91979 is an uncontrolled resource consumption (CWE-400) vulnerability in Vikunja, an open-source task and project management platform. Prior to version 2.6.0, the application fails to limit archive expansion during data import, allowing any authenticated user to upload a highly compressed archive that decompresses to tens of gigabytes in memory and on disk, exhausting server resources and crashing the instance. The vulnerability is remotely exploitable over the network by a low-privileged authenticated attacker with no user interaction, resulting in a high availability impact (CVSS 6.5). No public proof-of-concept, Nuclei template, or in-the-wild exploitation has been observed, and EPSS is very low (0.00338, 27.1st percentile).

Technical Analysis

Vikunja supports data import functionality that allows authenticated users to ingest externally produced task/project archives (for example, exports from the same or compatible applications). During import, the application extracts an uploaded archive and processes its contents. Per the NVD description, Vikunja "before 2.6.0 fails to limit archive expansion during data import." This is a classic archive-expansion / decompression-bomb condition: an attacker crafts an archive whose stored form is small (highly compressible content) but whose extracted form is extremely large, on the order of "tens of gigabytes in memory and disk."

The core weakness maps to CWE-400 — Uncontrolled Resource Consumption — and is functionally equivalent to CWE-409 (Improper Handling of Highly Compressed Data / decompression bomb). The flaw resides in the import code path: the server accepts an uploaded archive, then decompresses it without enforcing a maximum expansion ratio, a maximum uncompressed size, or a maximum member count. Because the compressed payload is small, network ingress controls and simple file-size limits do not prevent the attack.

Attack surface:

• Remote, network-accessible import endpoint reachable by an authenticated session (CVSS AV:N).
• No special privileges beyond a valid authenticated account (PR:L), and no victim interaction required (UI:N).
• No integrity or confidentiality impact (C:I / C:N); the sole impact is availability (A:H), yielding the 6.5 base score.

Note: the NVD description does not disclose specific function names, endpoints, parameters, or exact archive formats involved. The above describes the vulnerability class (unbounded archive expansion on import) as reported; implementation-level identifiers cannot be asserted and are not fabricated here.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred strictly from the vulnerability class (uncontrolled archive expansion during import).

1. Reconnaissance / target identification The attacker identifies an internet- or intranet-exposed Vikunja instance (self-hosted or managed) and determines that data-import functionality is available. The attacker obtains or creates a valid low-privileged account — self-registration, a provisioned user, or a compromised credential. Unauthenticated exploitation is not indicated, as the vector requires authenticated access (PR:L).

2. Triggering the flaw class The attacker crafts a small, highly compressed archive containing a payload designed to expand massively when decompressed (e.g., nested or high-ratio compression producing tens of gigabytes of output). The attacker submits this archive to the import functionality. Because the application does not bound expansion, the decompression routine allocates memory and writes data to disk until limits are exhausted.

3. Execution method (vulnerability-class level) The malicious archive is uploaded through the normal import flow; no memory-corruption or code execution is involved. The "execution" is resource exhaustion: memory allocation and disk consumption driven by decompression. The attacker can repeat or parallelize submissions to accelerate impact.

4. Post-exploitation impact Exhausted RAM and disk cause the Vikunja instance to slow, become unresponsive, or crash — a denial of service. In shared/containerized deployments, the resource pressure may affect co-located workloads. Data is neither read nor altered (per CVSS), so the objective is disruption rather than theft or tampering.

Impact Assessment

• Confidentiality: None (C:N). Integrity: None (I:N). Availability: High (A:H).
• Attack Vector: Network (AV:N); Complexity: Low (AC:L) — no race condition or specialized conditions; Privileges Required: Low (PR:L) — any authenticated user; User Interaction: None (UI:N); Scope: Unchanged (S:U).
• Business impact: service degradation or total unavailability of the task-management platform; loss of productivity, potential SLA breaches, and possible collateral pressure on shared infrastructure resources. Recovery may require process restarts and cleanup of large residual files.
• Blast radius: any Vikunja deployment running a version < 2.6.0 that exposes the import feature to authenticated users; internet-exposed instances are at greatest risk given the low-privilege requirement.
• Exploitability context: no public exploit, no KEV listing, EPSS ≈ 0.00338. Relative risk is driven less by exploit popularity than by the low bar (authenticated, low complexity) and the severe availability impact.

Detection Guidance

Sigma Rule

title: Vikunja Archive Expansion DoS via Data Import
id: 8f3c1a2e-2b6d-4c1a-9f0e-vikunja260
status: experimental
description: Detects potential abuse of Vikunja data import to trigger unbounded archive expansion (CVE-2026-91979)
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-91979
author: valtersit.com
date: 2026/01/01
logsource:
  product: vikunja
  service: application
detection:
  selection_import:
    http.request.method: 'POST'
    c-uri|contains:
      - '/import'
  selection_compress:
    c-uri|contains:
      - '.zip'
      - '.gz'
      - '.tar'
  condition: selection_import and selection_compress
fields:
  - client_ip
  - c-uri
  - cs-uri-query
falsepositives:
  - Legitimate large-but-bounded imports
level: medium

YARA Rule

rule CVE_2026_91979_Archive_Expansion_Import
{
    meta:
        author = "valtersit.com"
        description = "Detects highly compressed / archive-bomb style uploads associated with Vikunja import DoS (CVE-2026-91979)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-91979"
        date = "2026-01-01"
    strings:
        $method = "POST"
        $imp1 = "/import"
        $imp2 = "import"
        $zip = { 50 4B 03 04 }
        $gz  = { 1F 8B 08 }
    condition:
        $zip at 0 or $gz at 0
        and any of ($imp*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-91979 Vikunja Archive Expansion DoS Import Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"import"; nocase; pcre:"/import/i"; content:"application/zip"; http.header; nocase; sid:202691979; rev:1; reference:cve,2026-91979; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-91979; classtype:attempted-dos; metadata:service http;)

Elastic Detection

sequence by user.name with maxspan=5m
  [http where http.request.method == "POST" and stringContains(http.request.uri, "import")]
  [process where event.type == "start" and process.name != null]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=vikunja
| search method=POST uri_path="*import*"
| eval suspect=if(match(uri_path,"(?i)(import|upload)"),1,0)
| where suspect=1 AND (bytes < 1000000)
| stats count min(bytes) as min_bytes max(bytes) as max_bytes by src_ip, uri_path
| where count >= 1
| sort -count

Wazuh OSSEC Rule

<group name="vikunja,web,attack,">
  <rule id="2026910" level="10">
    <decoded_as>json</decoded_as>
    <field name="url">import</field>
    <field name="method">POST</field>
    <description>CVE-2026-91979: Possible Vikunja archive-expansion DoS import attempt</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>availability,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch (not independently confirmed)).

1. Immediate mitigations

• Restrict the import feature to trusted/administrator roles only; disable self-registration so attackers cannot trivially obtain an authenticated session.
• Enforce upload size limits and, where possible, decompressed-size and expansion-ratio limits at the reverse proxy / ingress layer.
• Apply per-process memory (cgroup) and disk quotas; monitor disk and memory growth to catch runaway expansion early.
• Do not expose the Vikunja instance directly to the internet unless required; place it behind authentication and network controls.

2. Patch / upgrade steps

• Upgrade Vikunja to 2.6.0 or later. The fix is reported via a single source (OSV) and is not independently confirmed — verify against the official project release notes before treating the issue as resolved.
• Restart the service after upgrade and validate import behavior with a controlled test archive.

3. Long-term hardening

• Add decompression safeguards to any archive-handling code path (max uncompressed size, max member count, expansion-ratio caps).
• Set container/OS resource limits (CPU, RAM, disk) so a single request cannot starve the host.
• Enable centralized logging for import actions and alert on anomalous expansion behavior.
• Track the NVD entry and vendor releases for confirmation of the patch.

References

1. NVD — CVE-2026-91979: https://nvd.nist.gov/vuln/detail/CVE-2026-91979
2. OSV — package/advisory data (patch claim source): https://osv.dev/
3. Vikunja project (vendor) release notes for 2.6.0: https://vikunja.io/
4. MITRE ATT&CK — T1499 Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/
5. CWE-400 Uncontrolled Resource Consumption: https://cwe.mitre.org/data/definitions/400.html

Exploit-in-the-wild evidence: None. CVE-2026-91979 is not listed in CISA KEV, no public PoC/exploit code exists, and no known threat-actor campaigns are associated with this CVE as of this report. EPSS 0.00338 (27.1st percentile).