CVE-2026-86255 — wger before 2.5 Uncontrolled Resource Consumption via date_sequence
wger before 2.5 fails to validate the maximum duration of routine date ranges, allowing authenticated users to create routines spanning arbitrarily long periods. Attackers can t…
Published: 2026-09-06 · CVSS: 7.1 · CVSS 4.0
wger before 2.5 fails to validate the maximum duration of routine date ranges, allowing authenticated users to create routines spanning arbitrarily long periods. Attackers can trigger the date_sequence computation via routine detail endpoints, forcing the server to iterate thousands of times per request and exhaust worker threads, denying service to legitimate users.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7