CVE-2026-35599

OVERVIEW CVE-2026-35599 affects Vikunja, an open-source self-hosted task management platform, in versions prior to 2.3.0. The vulnerability exists in the addRepeatIntervalToTime function, which uses an inefficient O(n) loop to advance task due dates. An attacker can exploit this by creating a repeating task with a minimal one-second interval and setting the due date far in the past, forcing the application to execute billions of loop iterations. SEVERITY The vulnerability carries a CVSS score of 6.5 (Medium) with network-based attack vector, low complexity, and no privilege escalation required. The impact is limited to availability, as the excessive loop iterations consume CPU resources and hold database connections for extended periods—potentially minutes per request—resulting in denial of service. The vulnerability requires low-level authentication (PR:L) but poses significant operational risk to affected instances. EXPLOITATION STATUS There is no evidence of active exploitation. The vulnerability does not appear on the Known Exploited Vulnerabilities (KEV) catalog, and community attention remains minimal with an EPSS score of 0.00045, indicating it ranks below the prevalence of most CVEs. The patch is available in version 2.3.0, and organizations running Vikunja should prioritize upgrades to mitigate this resource exhaustion risk.