Duplicate Advisory: Vikunja: Unbounded CSV row cardinality permits API process termination

{
  "id": "781c9ea32f0989bd88522390ae6790d311720aafbe1d6137272629af2fada900",
  "url": "https://osv.dev/vulnerability/GHSA-55p4-8j34-jv53",
  "method": "structured",
  "payload": {
    "kind": "withdrawal",
    "title": "Duplicate Advisory: Vikunja: Unbounded CSV row cardinality permits API process termination",
    "summary": "### Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-pqf9-h8g4-8gmh. This link is maintained to preserve external references. ### Original Description vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the POST /api/v2/migration/csv/migrate endpoint that fails to limit parsed row cardinality. Authenticated attackers can upload multipart CSV files with millions of tiny records to exhaust process memory and terminate the API service.",
    "evidence": "osv:GHSA-55p4-8j34-jv53",
    "products": [
      {
        "name": {
          "value": "code.vikunja.io/api",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "2.5.0",
            "evidence": "/affected/0/versions"
          }
        ]
      }
    ],
    "severity": "high",
    "structured": {
      "id": "GHSA-55p4-8j34-jv53",
      "aliases": [
        "GHSA-55p4-8j34-jv53"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
        },
        {
          "type": "CVSS_V4",
          "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
        }
      ],
      "affected": [
        {
          "package": {
            "name": "code.vikunja.io/api",
            "purl": "pkg:golang/code.vikunja.io/api",
            "ecosystem": "Go"
          },
          "versions": [
            "2.5.0"
          ],
          "database_specific": {
            "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-55p4-8j34-jv53/GHSA-55p4-8j34-jv53.json"
          }
        }
      ],
      "modified": "2026-10-09T21:00:05.525873316Z",
      "provider": "osv",
      "references": [
        "https://github.com/go-vikunja/vikunja/security/advisories/GHSA-pqf9-h8g4-8gmh",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-91969",
        "https://www.vulncheck.com/advisories/vikunja-before-2.6.0-resource-exhaustion-via-csv-migration"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-400"
        ],
        "severity": "HIGH",
        "github_reviewed": true,
        "nvd_published_at": "2026-09-15T16:17:53Z",
        "github_reviewed_at": "2026-10-09T20:53:08Z"
      }
    },
    "related_cves": [],
    "security_relevant": true,
    "severity_evidence": "/database_specific/severity"
  },
  "source_id": "core-osv",
  "document_id": 124137,
  "published_at": "2026-09-15T18:32:30+00:00"
}