What is GHSA-55p4-8j34-jv53?

GHSA-55p4-8j34-jv53 is a security advisory published by GitHub Security Advisories with High severity. Duplicate Advisory: Vikunja: Unbounded CSV row cardinality permits API process termination

Why does GHSA-55p4-8j34-jv53 have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

What is the CVSS v3 score of GHSA-55p4-8j34-jv53?

GHSA-55p4-8j34-jv53 has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

Which products are affected by GHSA-55p4-8j34-jv53?

GHSA-55p4-8j34-jv53 affects 1 product, including: go/code.vikunja.io/api:= 2.5.0.

⚠ Withdrawn by GitHub Security Advisories

Withdrawn: October 9, 2026

GHSA-55p4-8j34-jv53HighCVSS 6.5Disclosed before NVD

Duplicate Advisory: Vikunja: Unbounded CSV row cardinality permits API process termination

Vendor

GitHub Security Advisories

Published

September 15, 2026

Last Modified

October 9, 2026

📋 Description

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-pqf9-h8g4-8gmh. This link is maintained to preserve external references.

Original Description

vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the POST /api/v2/migration/csv/migrate endpoint that fails to limit parsed row cardinality. Authenticated attackers can upload multipart CSV files with millions of tiny records to exhaust process memory and terminate the API service.

🎯 Affected products1

go/code.vikunja.io/api:= 2.5.0

🔗 References (4)

https://github.com/go-vikunja/vikunja/security/advisories/GHSA-pqf9-h8g4-8gmh
https://nvd.nist.gov/vuln/detail/CVE-2026-91969
https://www.vulncheck.com/advisories/vikunja-before-2.6.0-resource-exhaustion-via-csv-migration
https://github.com/advisories/GHSA-55p4-8j34-jv53