Advisory Database
  • Advisories
  • Dependency Scanning
  1. pypi
  2. ›
  3. wger
  4. ›
  5. GHSA-v25j-wqcw-fvhj

GHSA-v25j-wqcw-fvhj: wger has an Uncontrolled Resource Consumption issue

May 13, 2026

Any authenticated user can create a routine spanning an arbitrarily long date range (e.g. 100 years) and then trigger the date_sequence computation via any of the routine detail endpoints. The server iterates once per day in an unbounded while loop with no maximum duration validation, causing a single HTTP request to consume multiple seconds of server CPU and return a response containing tens of thousands of entries. Repeated requests can exhaust all worker threads and deny service to other users.

References

  • github.com/advisories/GHSA-v25j-wqcw-fvhj
  • github.com/wger-project/wger/commit/5f07a4473e2c32d298c8cdd31d78e5107840039c
  • github.com/wger-project/wger/security/advisories/GHSA-v25j-wqcw-fvhj

Code Behaviors & Features

Detect and mitigate GHSA-v25j-wqcw-fvhj with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →

Affected versions

All versions up to 2.5.0

Solution

Unfortunately, there is no solution available yet.

Impact 6.5 MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Learn more about CVSS

Weakness

  • CWE-400: Uncontrolled Resource Consumption

Source file

pypi/wger/GHSA-v25j-wqcw-fvhj.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Sun, 08 Nov 2026 00:15:53 +0000.