ghsa:GHSA-55P4-8J34-JV53: code.vikunja.io/api = 2.5.0

Affected technology

code.vikunja.io/api · = 2.5.0
Vendor not specified by the source

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

Authenticated attackers can upload multipart CSV files with millions of tiny records to exhaust process memory and terminate the API service. Source advisory’s CVSS 3.1 assessment rates confidentiality and integrity impact as none; availability impact as high.