p PatchFirst

CVE-2026-86255

CVE-2026-86255 · wger before 2.5 Uncontrolled Resource Consumption via date_sequence

This page contains facts from public vulnerability sources. Check the original advisory before updating.

wger before 2.5 fails to validate the maximum duration of routine date ranges, allowing authenticated users to create routines spanning arbitrarily long periods. Attackers can trigger the date_sequence computation via routine detail endpoints, forcing the server to iterate thousands of times per request and exhaust worker threads, denying service to legitimate users.

CVSS 7.1 · High · EPSS 0.4% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • wger

    Versions
    • ≥ 0, < 2.5: Affected (custom)
    • 2.5: Not affected (custom)

    Update to 2.5

  • wger PyPI

    Versions
    • 1.1
    • 1.1.1
    • 1.2
    • 1.2rc1
    • 1.3
    • 1.4
    • 1.5
    • 1.6
    • 1.6.1
    • 1.7
    • 1.8
    • 1.9
    • 2.0
    • 2.1
    Affected ranges
    • ECOSYSTEM: ≤ 2.5

    No fix published

Original sources

Check your server →