CVE-2026-116871GHSA-f8vw-wvm6-h2qq
SemanticMediaWiki: Semantic MediaWiki 3.0.0 before 7.3.1 Uncontrolled Recursion via Special:Ask
SemanticMediaWiki SemanticMediaWiki
CVSS
8.7HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
What fixes it
- 7.3.1SemanticMediaWikiCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Semantic MediaWiki 3.0.0 before 7.3.1 contains an uncontrolled recursion vulnerability in LegacyParser::getSubqueryDescription() that processes nested query tokens before depth limits apply. Unauthenticated attackers can submit deeply nested query elements to the action=ask API to consume substantial CPU and memory, tying up request workers.
Text from CVE List
Affected versions 2
- SemanticMediaWikiaffected: 3.0.0 before 7.3.1CVE List
- SemanticMediaWikiunaffected: 7.3.1CVE List
References 4
- github.com/SemanticMediaWiki/SemanticMediaWiki/commit/756492002752f937a9e115e14330b1181bd8c60cFixvia CVE List
- github.com/SemanticMediaWiki/SemanticMediaWiki/commit/e642f38c708dee7da5e885b8d40be8ffc56f3e87Fixvia CVE List
- github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-f8vw-wvm6-h2qqAdvisoryvia CVE List
- vulncheck.com/advisories/semantic-mediawiki-3.0.0-before-7.3.1-uncontrolled-recursion-via-special-askAdvisoryvia CVE List