Live › vulnerability › CVE-2026-116872
Go to dashboardSemantic MediaWiki from 3.0.0 before 7.3.1 has a quadratic-time parser in TermParser::normalize_compact_form(). An unauthenticated attacker can send long search terms with many in:(...) or has:(...) expressions to Special:Search and exhaust PHP search workers.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 11:31 UTC. All times on this page are UTC.
Wikis running Semantic MediaWiki from 3.0.0 up to but not including 7.3.1 are exposed, and the exposure matters when the extended search engine is enabled, because that is the path that reaches the vulnerable parser. Wikis on versions outside that range or with the extended search engine disabled are less exposed. unknown whether other configurations are affected.
No product ranges from the sources yet.
mediawiki/semantic-media-wiki.7.3.1 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Semantic MediaWiki from 3.0.0 before 7.3.1 contains an algorithmic complexity vulnerability in TermParser::normalize_compact_form() that allows unauthenticated attackers to cause quadratic CPU consumption. Attackers can submit long search terms with many distinct in:(...) or has:(...) expressions to Special:Search to exhaust PHP search workers when the extended search engine is enabled.
This page as .md · .json · in your agent: get_signal("CVE-2026-116872")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.