CVE-2026-86255— wger before 2.5 Uncontrolled Resource Consumption via date_sequence
Quick assessment
Affected
wger-project wger
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 wger 2.5 之前的版本中，系统未能验证计划（routine）日期范围的最大持续时间，这使得经过身份验证的用户可以创建跨度任意长的训练计划。攻击者可以通过访问计划详情接口触发 的计算过程，迫使服务器在每次请求中执行数千次迭代，从而耗尽工作线程资源，导致无法为合法用户提供正常服务（即拒绝服务攻击，DoS）。
Possible ATT&CK Techniques 1 AI
T1499 · Endpoint Denial of ServiceAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| wger-project | wger | < 2.5 |
affected |
2.5 |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-86255
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
wger before 2.5 Uncontrolled Resource Consumption via date_sequence
Source: CVE Program / CVE List V5
Vulnerability Description
wger before 2.5 fails to validate the maximum duration of routine date ranges, allowing authenticated users to create routines spanning arbitrarily long periods. Attackers can trigger the date_sequence computation via routine detail endpoints, forcing the server to iterate thousands of times per request and exhaust worker threads, denying service to legitimate users.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| wger-project | wger | 0 ~ 2.5 | - |
|
II. Public POCs for CVE-2026-86255
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-86255
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-86255 (2)
Same Patch Batch · wger-project · 2026-09-06 · 4 CVEs total
| CVE-2026-86254 | 6.8 MEDIUM | wger Incomplete Authorization Fix Cross-Tenant Account Deletion |
| CVE-2026-86256 | 5.4 MEDIUM | wger before 2.6 Open Redirect via trainer-login next parameter |
| CVE-2026-86257 | 5.4 MEDIUM | wger before 2.6 CSV Formula Injection via member export |
IV. Related Vulnerabilities
Same product: wger
-
CVE-2026-86257
wger before 2.6 CSV Formula Injection via member export -
CVE-2026-86256
wger before 2.6 Open Redirect via trainer-login next paramet -
CVE-2026-86254
wger Incomplete Authorization Fix Cross-Tenant Account Delet -
CVE-2026-82544
wger-project wger Password Reset gym.py reset_user_password -
CVE-2026-43977
wger IDOR: Authenticated Users Can Read Others' Private Work
Same vendor: wger-project
-
CVE-2026-86257
wger before 2.6 CSV Formula Injection via member export -
CVE-2026-86256
wger before 2.6 Open Redirect via trainer-login next paramet -
CVE-2026-86254
wger Incomplete Authorization Fix Cross-Tenant Account Delet -
CVE-2026-82544
wger-project wger Password Reset gym.py reset_user_password -
CVE-2026-43977
wger IDOR: Authenticated Users Can Read Others' Private Work
Same weakness: CWE-400
-
CVE-2026-86250
h3 before 2.0.1-rc.18 Denial of Service via Unbounded Chunke -
CVE-2020-37277
PocketMine-MP before 3.15.4 Denial of Service via InventoryT -
CVE-2026-55512
nebula-mesh: Unauthenticated OIDC login endpoint allocates u -
CVE-2026-19645
Multiple vulnerabilities in IBM MQ Agent images -
CVE-2026-85585
SiYuan before v3.8.2 Unbounded Memory Consumption via Contro
V. Comments for CVE-2026-86255
No comments yet