Live › vulnerability › CVE-2026-116871
Go to dashboardSemantic MediaWiki 3.0.0 before 7.3.1 recurses without a depth limit when parsing nested query tokens in LegacyParser::getSubqueryDescription(). An unauthenticated attacker can send deeply nested queries to the action=ask API to consume CPU and memory and tie up request workers, causing denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 11:31 UTC. All times on this page are UTC.
Wikis running Semantic MediaWiki from 3.0.0 up to but not including 7.3.1 that serve the action=ask API to unauthenticated visitors are exposed. Sites that are on 7.3.1 or later, or that restrict the API to logged-in users, are less exposed. The sources do not say whether other configurations change exposure.
No product ranges from the sources yet.
mediawiki/semantic-media-wiki, and see whether it is 3.0.0 through 7.3.0.7.3.1 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Semantic MediaWiki 3.0.0 before 7.3.1 contains an uncontrolled recursion vulnerability in LegacyParser::getSubqueryDescription() that processes nested query tokens before depth limits apply. Unauthenticated attackers can submit deeply nested query elements to the action=ask API to consume substantial CPU and memory, tying up request workers.
This page as .md · .json · in your agent: get_signal("CVE-2026-116871")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.