Medium severity · published Sep 6, 2026
CVE-2026-86255
wger before 2.5 Uncontrolled Resource Consumption via date_sequence
6.5
CVSS
0.4%
EPSS
No
On KEV
Description
wger before 2.5 fails to validate the maximum duration of routine date ranges, allowing authenticated users to create routines spanning arbitrarily long periods. Attackers can trigger the date_sequence computation via routine detail endpoints, forcing the server to iterate thousands of times per request and exhaust worker threads, denying service to legitimate users.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 38% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WG
wger · wger-project
before 2.5 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-86255
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-86255
github.com
https://github.com/wger-project/wger/security/advisories/GHSA-v25j-wqcw-fvhj
www.vulncheck.com
https://www.vulncheck.com/advisories/wger-before-2.5-uncontrolled-resource-consumption-via-date-sequence
More from wger
9.9
CVE-2026-43948
wger: cross-tenant password reset and plaintext disclosure via gym=None bypass
8.1
CVE-2026-43978
wger: Privilege escalation via trainer-login session chaining allows gym trainers to impersonate gym managers
7.6
CVE-2026-40474
wger has Broken Access Control in the Global Gym Configuration Update Endpoint
7.5
CVE-2026-43977
wger IDOR: Authenticated Users Can Read Others' Private Workout Session Data via Template Routine API
7.1
CVE-2026-46434
wger: Trainer Privilege Escalation - Improper Privilege Management