Vikunja Planka Migration OOM: Unbounded Attachment Aggregation

Key Vulnerability Information Summary Vulnerability Overview Vulnerability Name: Unbounded aggregation of attacker-provided attachments in Planka migration, potentially leading to API Out-Of-Memory (OOM) Vulnerability Type: Resource Exhaustion Affected Component: The worker handling asynchronous migration requests for Vulnerability Description: - The asynchronously registered Planka migration feature allows importing Planka data into Vikunja - The conversion process downloads each attachment to disk independently, but the conversion process downloads all validated remote attachments and retains the full content of each attachment in memory until completion - An attacker can exhaust server memory by submitting a large number or large-size attachments, causing the API process to terminate due to OOM Scope of Impact Affected Versions: > 2.5.0 Fixed Version: 2.6.0 Severity: CVSS v3.1 Base Score 7.5 (High) CWE: CWE-770 (Resource Exhaustion) Fix Details Fixed Version: 2.6.0 Fix Description: In 2.6.0, for the affected 2.5.x branch, the issue was independently reproduced in the release build POC Code 1. Create ```dockerfile FROM golang:1.27-bookworm AS builder WORKDIR /src COPY --from=alpine /etc/ssl/certs/ca-certificates.crt \ /etc/ssl/certs/ca-certificates.crt COPY --from=alpine /usr/local/share/ca-bundle.crt \ /usr/local/share/ca-bundle.crt COPY --from=alpine /usr/local/share/ca-bundle.pem \ /usr/local/share/ca-bundle.pem COPY --from=alpine /usr/local/share/ca-bundle.crt \ /usr/local/share/ca-bundle.crt COPY --from=alpine /usr/local/share/ca-bundle.pem \ /usr/local/share/ca-bundle.pem COPY --from=alpine /usr/local/share/ca-bundle.crt \ /usr/local/share/ca-bundle.crt COPY --from=alpine /usr/local/share/ca-bundle.pem \ /usr/local/share/ca-bundle.pem COPY --from=alpine /usr/local/share/ca-bundle.crt \ /usr/local/share/ca-bundle.crt COPY --from=alpine /usr/local/share/ca-bundle.pem \ /usr/local/share/ca-bundle.pem COPY --from=alpine /usr/local/share/ca-bundle.crt \ /usr/local/share/ca-bundle.crt COPY --from=alpine /usr/local/share/ca-bundle.pem \ /usr/local/share/ca-bundle.pem COPY --from=alpine /usr/local/share/ca-bundle.crt \ /usr/local/share/ca-bundle.crt COPY --from=alpine /usr/local/share/ca-bundle.pem \ /usr/local/share/ca-bundle.pem COPY --from=alpine /usr/local/share/ca-bundle.crt \ /usr/local/share/ca-bundle.crt COPY --from=alpine /usr/local/share/ca-bundle.pem \ /usr/local/share/ca-bundle.pem COPY --from=alpine /usr/local/share/ca-bundle.crt \ /usr/local/share/ca-bundle.crt COPY --from=alpine /usr/local/share/ca-bundle.pem \ /usr/local/share/ca-bundle.pem COPY --from=alpine /usr/local/share/ca-bundle.crt \ /usr/local/share/ca-bundle.crt COPY --from=alpine /usr/local/share/ca-bundle.pem \ /usr/local/share/ca-bundle.pem COPY --from=alpine /usr/local/share/ca-bundle.crt \ /usr/local/share/ca-bundle.crt COPY --from=alpine /usr/local/share/ca-bundle.pem \ /usr/local/share/ca-bundle.pem COPY --from=alpine /usr/local/share/ca-bundle.crt \ /usr/local/share/ca-bundle.crt COPY --from=alpine /usr/local/share/ca-bundle.pem \ /usr/local/share/ca-bundle.pem COPY --from=alpine /usr/local/share/ca-bundle.crt \ /usr/local/share/ca-bundle.crt COPY --from=alpine /usr/local/share/ca-bundle.pem \ /usr/local/share/ca-bundle.pem COPY --from=alpine /usr/local/share/ca-bundle.crt \ /usr/local/share/ca-bundle.crt COPY --from=alpine /usr/local/share/ca-bundle.pem \ /usr/local/share/ca-bundle.pem COPY --from=alpine /usr/local/share/ca-bundle.crt \ /usr/local/share/ca-bundle.crt COPY --from=alpine /usr/local/share/ca-bundle.pem \ /usr/local/share/ca-bundle.pem COPY --from=alpine /usr/local/share/ca-bundle.crt \ /usr/local/share/ca-bundle.crt COPY --from=alpine /usr/local/share/ca-bundle.pem \ /usr/local/share/ca-bundle.pem COPY --from=alpine /usr/local/share/ca-bundle.crt \ /usr/local/share/ca-bundle.crt COPY --from=alpine /usr/local/share/ca-bundle.pem \ /usr/local/share/ca-bundle.pem COPY --from=alpine /usr/local/share/ca-bundle.crt \ /usr/local/share/ca-bundle.crt COPY --from=alpine /usr/local/share/ca-bundle.pem \ /usr/local/share/ca-bundle.pem COPY --from=alpine /usr/local/share/ca-bundle.crt \ /usr/local/share/ca-bundle.crt COPY --from=alpine /usr/local/share/ca-bundle.pem \ /usr/local/share/ca-bundle.pem COPY --from=alpine /usr/local/share/ca-bundle.crt \ /usr/local/share/ca-bundle.crt COPY --from=alpine /usr/local/share/ca-bundle.pem \ /usr/local/share/ca-bundle.pem COPY --from=alpine /usr/local/share/ca-bundle.crt \ /usr/local/share/ca-bundle.crt COPY --from=alpine /usr/local/share/ca-bundle.pem \ /usr/local/share/ca-bundle.pem COPY --from=alpine /usr/local/share/ca-bundle.crt \ /usr/local/share/ca-bundle.crt COPY --from=alpine /usr/local/share/ca-bundle.pem \ /usr/local/share/ca-bundle.pem COPY --from=alpine /usr/local/share/ca-bundle.crt \ /usr/local/share/ca-bundle.crt COPY --from=alpine /usr/local/share/ca-bundle.pem \ /usr/local/share/ca-bundle.pem COPY --from=alpine /usr/local/share/ca-bundle.crt \ /usr/local/share/ca-b

Goal Reached Thanks to every supporter — we hit 100%!

Vikunja Planka Migration OOM: Unbounded Attachment Aggregation

More from this source