CVE-2026-33474 - Vikunja Affected by DoS via Image Preview Generation

Back Back to CVE browser

MEDIUM

Vikunja Affected by DoS via Image Preview Generation

Published Mar 24, 2026

6.5

MEDIUM

CVSS 3.1

EPSS 0.47%

Description

Vikunja is an open-source self-hosted task management platform. Starting in version 1.0.0-rc0 and prior to version 2.2.0, unbounded image decoding and resizing during preview generation lets an attacker exhaust CPU and memory with highly compressed but extremely large-dimension images. Version 2.2.0 patches the issue.

Affected products

Vendor GO-Vikunja Product Vikunja Default
unknown
Affected
- ≥ 1.0.0-rc0, < 2.2.0

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
GO-Vikunja	Vikunja	unknown	Affected ≥ 1.0.0-rc0, < 2.2.0

Ecosystem	Package	Introduced	Fixed
Go	code.vikunja.io/api	0	not fixed

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-400

Uncontrolled Resource Consumption

References (5)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-20082
Advisory
https://github.com/advisories/GHSA-wc83-79hj-hpmq
Advisory
https://github.com/go-vikunja/vikunja/security/advisories/GHSA-wc83-79hj-hpmq
x_refsource_CONFIRMExploitVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-33474
https://vikunja.io/changelog/vikunja-v2.2.0-was-released
x_refsource_MISCRelease Notes

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-20082		Advisory
https://github.com/advisories/GHSA-wc83-79hj-hpmq		Advisory
https://github.com/go-vikunja/vikunja/security/advisories/GHSA-wc83-79hj-hpmq		x_refsource_CONFIRMExploitVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-33474
https://vikunja.io/changelog/vikunja-v2.2.0-was-released		x_refsource_MISCRelease Notes