Cloudanix VulnDB

GHSA-v25j-wqcw-fvhj

Medium · 6.5

wger has an Uncontrolled Resource Consumption issue

CVSS

6.5

EPSS

—

Published

May 13, 2026

CISA due date

—

The record

Any authenticated user can create a routine spanning an arbitrarily long date range (e.g. 100 years) and then trigger the `date_sequence` computation via any of the routine detail endpoints. The server iterates once per day in an unbounded `while` loop with no maximum duration validation, causing a single HTTP request to consume multiple seconds of server CPU and return a response containing tens of thousands of entries. Repeated requests can exhaust all worker threads and deny service to other users.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities