{"id":"CVE-2026-116872","kind":"vulnerability","aliases":["CVE-2026-116872"],"related":[],"title":"Semantic MediaWiki: crafted search terms exhaust CPU via quadratic parsing","description":"Semantic MediaWiki from 3.0.0 before 7.3.1 contains an algorithmic complexity vulnerability in TermParser::normalize_compact_form() that allows unauthenticated attackers to cause quadratic CPU consumption. Attackers can submit long search terms with many distinct in:(...) or has:(...) expressions to Special:Search to exhaust PHP search workers when the extended search engine is enabled.","summary":"Semantic MediaWiki from 3.0.0 before 7.3.1 has a quadratic-time parser in TermParser::normalize_compact_form(). An unauthenticated attacker can send long search terms with many in:(...) or has:(...) expressions to Special:Search and exhaust PHP search workers.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mediawiki","package","php","self-hosted","semantic-mediawiki"],"not_affected_if":["extended-search-disabled","version-7.3.1-or-later"],"how_to_check":"- Check the installed Semantic MediaWiki version in the wiki's Special:Version page or in composer.lock for `mediawiki/semantic-media-wiki`.\n- Check whether the extended search engine is enabled in the wiki's LocalSettings.php configuration.","fix":"- Upgrade Semantic MediaWiki to `7.3.1` or later.","status":"open","published_at":"2026-10-27T11:17:28+00:00","first_seen_at":"2026-10-27T11:31:27+00:00","triaged_at":"2026-10-27T11:31:41+00:00","updated_at":"2026-10-27T11:31:41+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-27T11:31:41Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Semantic MediaWiki to `7.3.1` or later.","reach":"internet","title":"Semantic MediaWiki: crafted search terms exhaust CPU via quadratic parsing","impact":"medium","summary":"Semantic MediaWiki from 3.0.0 before 7.3.1 has a quadratic-time parser in TermParser::normalize_compact_form(). An unauthenticated attacker can send long search terms with many in:(...) or has:(...) expressions to Special:Search and exhaust PHP search workers.","category":"package","nicknames":[],"who_cares":["mediawiki","semantic-mediawiki","self-hosted","php"],"confidence":0.7,"needs_auth":"no","worst_case":"Search workers are exhausted by unauthenticated requests, causing denial of service.","analyst_note":"","how_to_check":"- Check the installed Semantic MediaWiki version in the wiki's Special:Version page or in composer.lock for `mediawiki/semantic-media-wiki`.\n- Check whether the extended search engine is enabled in the wiki's LocalSettings.php configuration.","needs_analyst":false,"not_affected_if":["version-7.3.1-or-later","extended-search-disabled"],"who_is_affected":"Wikis running Semantic MediaWiki from 3.0.0 up to but not including 7.3.1 are exposed, and the exposure matters when the extended search engine is enabled, because that is the path that reaches the vulnerable parser. Wikis on versions outside that range or with the extended search engine disabled are less exposed. unknown whether other configurations are affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000635,"input_tokens":3365,"output_tokens":596,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116872':13A,16A '-2026':12A,15A '3.0.0':29B,68C '7.3.1':31B,70C 'algorithm':73C 'allow':82C 'attack':45B,84C,90C 'caus':86C 'compact':41B,79C 'complex':74C 'consumpt':89C 'contain':71C 'cpu':7A,88C 'craft':3A 'cve':11A,14A 'distinct':98C 'enabl':117C 'engin':115C 'exhaust':6A,61B,107C 'express':56B,102C 'extend':113C 'form':42B,80C 'host':22B 'long':48B,93C 'mani':52B,97C 'mediawiki':2A,17B,25B,27B,66C 'normal':40B,78C 'packag':18B 'pars':10A 'parser':37B 'php':19B,62B,108C 'quadrat':9A,35B,87C 'quadratic-tim':34B 'search':4A,49B,59B,63B,94C,105C,109C,114C 'self':21B 'self-host':20B 'semant':1A,24B,26B,65C 'semantic-mediawiki':23B 'send':47B 'special':58B,104C 'submit':92C 'term':5A,50B,95C 'termpars':39B,77C 'time':36B 'unauthent':44B,83C 'via':8A 'vulner':75C 'worker':64B,110C","nicknames":[],"mitigations":[],"who_affected":"Wikis running Semantic MediaWiki from 3.0.0 up to but not including 7.3.1 are exposed, and the exposure matters when the extended search engine is enabled, because that is the path that reaches the vulnerable parser. Wikis on versions outside that range or with the extended search engine disabled are less exposed. unknown whether other configurations are affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T11:17:28+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116872","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116872","severity":null,"published_at":"2026-10-27T11:17:28+00:00","modified_at":"2026-10-27T11:17:28+00:00","first_seen_at":"2026-10-27T11:31:27+00:00","fetched_at":"2026-10-27T11:31:27+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}