{"id":"CVE-2026-116877","kind":"vulnerability","aliases":["CVE-2026-116877"],"related":[],"title":"Semantic MediaWiki: recurring-event limit bypass lets editors exhaust server resources","description":"Semantic MediaWiki from 2.5.0 before 7.3.1 contains an uncontrolled resource consumption vulnerability that allows low-privilege editors to bypass smwgMaxNumRecurringEvents by supplying a large limit parameter. Attackers can save pages using #set_recurring_event without an end date to generate thousands or millions of date subobjects, exhausting CPU, memory, and database resources.","summary":"Semantic MediaWiki versions 2.5.0 through 7.3.0 let a low-privilege editor bypass the smwgMaxNumRecurringEvents limit by supplying a large limit parameter. Saving a page with #set_recurring_event and no end date can generate millions of date subobjects, exhausting CPU, memory and database resources.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mediawiki","package","self-hosted","semantic-mediawiki"],"not_affected_if":["extension-not-installed","trusted-editors-only"],"how_to_check":"- Check the installed Semantic MediaWiki version in Special:Version or in the extension's composer.lock or extension.json; affected if it is from `2.5.0` before `7.3.1`.\n- Search wiki pages for `#set_recurring_event` to see whether the parser function is in use.","fix":"- Upgrade Semantic MediaWiki to `7.3.1` or later.","status":"open","published_at":"2026-10-27T11:17:29+00:00","first_seen_at":"2026-10-27T11:31:27+00:00","triaged_at":"2026-10-27T11:31:41+00:00","updated_at":"2026-10-27T11:31:41+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-27T11:31:41Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Semantic MediaWiki to `7.3.1` or later.","reach":"network","title":"Semantic MediaWiki: recurring-event limit bypass lets editors exhaust server resources","impact":"medium","summary":"Semantic MediaWiki versions 2.5.0 through 7.3.0 let a low-privilege editor bypass the smwgMaxNumRecurringEvents limit by supplying a large limit parameter. Saving a page with #set_recurring_event and no end date can generate millions of date subobjects, exhausting CPU, memory and database resources.","category":"package","nicknames":[],"who_cares":["mediawiki","semantic-mediawiki","self-hosted"],"confidence":0.8,"needs_auth":"yes","worst_case":"Low-privilege editor exhausts server CPU, memory and database resources","analyst_note":"","how_to_check":"- Check the installed Semantic MediaWiki version in Special:Version or in the extension's composer.lock or extension.json; affected if it is from `2.5.0` before `7.3.1`.\n- Search wiki pages for `#set_recurring_event` to see whether the parser function is in use.","needs_analyst":false,"not_affected_if":["extension-not-installed","trusted-editors-only"],"who_is_affected":"Wikis running Semantic MediaWiki between 2.5.0 and 7.3.0 that let non-administrator editors save pages. The exposure depends on editors being able to use the #set_recurring_event parser function with no end date. Wikis where only trusted users can edit, or that do not run the extension, can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000631,"input_tokens":3367,"output_tokens":589,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116877':15A,18A '-2026':14A,17A '2.5.0':30B,75C '7.3.0':32B '7.3.1':77C 'allow':85C 'attack':99C 'bypass':7A,39B,91C 'consumpt':82C 'contain':78C 'cpu':67B,120C 'cve':13A,16A 'databas':70B,123C 'date':59B,64B,110C,117C 'editor':9A,38B,89C 'end':58B,109C 'event':5A,55B,106C 'exhaust':10A,66B,119C 'generat':61B,112C 'host':23B 'larg':46B,96C 'let':8A,33B 'limit':6A,42B,47B,97C 'low':36B,87C 'low-privileg':35B,86C 'mediawiki':2A,19B,26B,28B,73C 'memori':68B,121C 'million':62B,115C 'packag':20B 'page':51B,102C 'paramet':48B,98C 'privileg':37B,88C 'recur':4A,54B,105C 'recurring-ev':3A 'resourc':12A,71B,81C,124C 'save':49B,101C 'self':22B 'self-host':21B 'semant':1A,25B,27B,72C 'semantic-mediawiki':24B 'server':11A 'set':53B,104C 'smwgmaxnumrecurringev':41B,92C 'subobject':65B,118C 'suppli':44B,94C 'thousand':113C 'uncontrol':80C 'use':103C 'version':29B 'vulner':83C 'without':107C","nicknames":[],"mitigations":[],"who_affected":"Wikis running Semantic MediaWiki between 2.5.0 and 7.3.0 that let non-administrator editors save pages. The exposure depends on editors being able to use the #set_recurring_event parser function with no end date. Wikis where only trusted users can edit, or that do not run the extension, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T11:17:29+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116877","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116877","severity":null,"published_at":"2026-10-27T11:17:29+00:00","modified_at":"2026-10-27T11:17:29+00:00","first_seen_at":"2026-10-27T11:31:27+00:00","fetched_at":"2026-10-27T11:31:27+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}