GHSA-V25J-WQCW-FVHJ: Uncontrolled Resource Consumption via Unbounded Date Sequences in wger

Vulnerability ID: GHSA-V25J-WQCW-FVHJ

CVSS Score: 7.5

Published: 2026-05-13

wger is susceptible to an authenticated Denial of Service (DoS) vulnerability due to uncontrolled resource consumption (CWE-400). The flaw resides in the application's handling of date sequences within routine configurations, allowing authenticated attackers to exhaust server resources by defining enormous date ranges.

TL;DR

Authenticated attackers can trigger a Denial of Service by creating workout routines with excessively large date ranges, causing unbounded loops that exhaust server CPU and worker threads.

⚠️ Exploit Status: POC

Technical Details

CWE ID : CWE-400

Attack Vector : Network (Authenticated API)

Impact : Denial of Service (CPU Exhaustion)

Exploit Status : Proof-of-Concept

Patch Status : Available

CVSS Severity : High (7.5 estimated)

Affected Systems

wger Workout Manager backend API

wger : < commit…