CVE-2026-33474 — Uncontrolled Resource Consumption in API

CWE-400 — Uncontrolled Resource Consumption5 documents4 sources
Severity
6.5MEDIUMNVD
EPSS
0.0%
top 85.79%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Code.vikunja.io APIVikunjaGo-vikunja Vikunja
Timeline
Latest updateMar 23
PublishedMar 24

Description

Vikunja is an open-source self-hosted task management platform. Starting in version 1.0.0-rc0 and prior to version 2.2.0, unbounded image decoding and resizing during preview generation lets an attacker exhaust CPU and memory with highly compressed but extremely large-dimension images. Version 2.2.0 patches the issue.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages3 packages

▶NVDvikunja/vikunja1.0.0 — 2.2.0
▶Gocode.vikunja.io/api1.0.0-rc0 — 2.2.0
▶CVEListV5go-vikunja/vikunja>= 1.0.0-rc0, < 2.2.0

🔴Vulnerability Details

3
OSV
Vikunja Affected by DoS via Image Preview Generation in code.vikunja.io/api↗2026-03-23
▶
OSV
Vikunja Affected by DoS via Image Preview Generation↗2026-03-20
▶
GHSA
Vikunja Affected by DoS via Image Preview Generation↗2026-03-20
▶

🕵️Threat Intelligence

1
Wiz
CVE-2026-33474 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶