Live › vulnerability › CVE-2026-116877
Go to dashboardSemantic MediaWiki versions 2.5.0 through 7.3.0 let a low-privilege editor bypass the smwgMaxNumRecurringEvents limit by supplying a large limit parameter. Saving a page with #set_recurring_event and no end date can generate millions of date subobjects, exhausting CPU, memory and database resources.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 11:31 UTC. All times on this page are UTC.
Wikis running Semantic MediaWiki between 2.5.0 and 7.3.0 that let non-administrator editors save pages. The exposure depends on editors being able to use the #set_recurring_event parser function with no end date. Wikis where only trusted users can edit, or that do not run the extension, can skip it.
No product ranges from the sources yet.
2.5.0 before 7.3.1.#set_recurring_event to see whether the parser function is in use.7.3.1 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Semantic MediaWiki from 2.5.0 before 7.3.1 contains an uncontrolled resource consumption vulnerability that allows low-privilege editors to bypass smwgMaxNumRecurringEvents by supplying a large limit parameter. Attackers can save pages using #set_recurring_event without an end date to generate thousands or millions of date subobjects, exhausting CPU, memory, and database resources.
This page as .md · .json · in your agent: get_signal("CVE-2026-116877")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.