Description

wger before 2.5 fails to validate the maximum duration of routine date ranges, allowing authenticated users to create routines spanning arbitrarily long periods. Attackers can trigger the date_sequence computation via routine detail endpoints, forcing the server to iterate thousands of times per request and exhaust worker threads, denying service to legitimate users.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-06T12:17:16.433Z",
  "pubdate": "2026-09-06T12:17:16.433Z",
  "executiveSummary": "This vulnerability, affecting wger versions prior to 2.5, constitutes an application-level Denial-of-Service (DoS) flaw originating from improper input validation regarding routine duration constraints.\nThe issue arises because the application fails to enforce upper bounds on the date ranges defined for user routines.\nBy manipulating routine parameters, an authenticated attacker can force the backend to perform an excessive number of iterations during the date_sequence computation.\nThis behavior results in resource exhaustion, specifically targeting worker threads, which renders the service unavailable to legitimate users.\nThe vulnerability requires authenticated access, granting an attacker the ability to induce server-side resource depletion through standard routine detail endpoints.\nThe primary risk implication is the degradation or complete loss of service availability, potentially impacting all users of the affected wger instance.\nThere are no requirements for elevated administrative privileges beyond standard authenticated access to exploit this vulnerability.",
  "technicalDetails": "The vulnerability resides within the routine management logic of wger, specifically in how the application processes and computes routine date ranges. In versions prior to 2.5, the application lacks sufficient input validation to constrain the maximum time span permissible for a routine's date range.\nThe core issue is a logic flaw in the date_sequence computation function. When a user creates or modifies a routine, they can specify an arbitrarily long duration for the routine. The application logic subsequently attempts to compute every individual occurrence or step within this range upon request.\nThe attack flow begins when an authenticated user sends a crafted request to the routine detail endpoints. By submitting parameters that define a massive temporal range, the attacker forces the backend to perform an iterative calculation loop. Because there is no check for the maximum duration of these routines, the loop size is effectively controlled by the attacker via the input duration parameter.\nUpon reaching the server, the application iterates thousands, or potentially millions of times, to generate the sequence of dates for the routine. This process is computationally expensive and is executed within the context of the server's worker threads. Since these threads are responsible for handling incoming HTTP requests, a single, sufficiently large request will block the worker thread for an extended period.\nIn a multi-worker environment, an attacker can launch multiple concurrent requests to exhaust all available worker threads. Once the thread pool is fully consumed by these intensive computations, the application becomes incapable of processing further requests, leading to a complete Denial-of-Service for all users.\nThis vulnerability is classified as an algorithmic complexity attack, where the attacker leverages the server's own processing logic against it. The exposure is limited to authenticated users, but since any registered user can create and trigger these routine calculations, the attack surface is broad. Post-exploitation impact is limited to the exhaustion of server resources and the subsequent denial of service, with no evidence of unauthorized data access or code execution."
}