CVE-2026-116877GHSA-vxrm-2g9f-2vqh
SemanticMediaWiki: Semantic MediaWiki 2.5.0 before 7.3.1 Resource Exhaustion via #set_recurring_event
SemanticMediaWiki SemanticMediaWiki
CVSS
8.7HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
What fixes it
- 7.3.1SemanticMediaWikiCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Semantic MediaWiki from 2.5.0 before 7.3.1 contains an uncontrolled resource consumption vulnerability that allows low-privilege editors to bypass smwgMaxNumRecurringEvents by supplying a large limit parameter. Attackers can save pages using #set_recurring_event without an end date to generate thousands or millions of date subobjects, exhausting CPU, memory, and database resources.
Text from CVE List
Affected versions 2
- SemanticMediaWikiaffected: 2.5.0 before 7.3.1CVE List
- SemanticMediaWikiunaffected: 7.3.1CVE List
References 3
- github.com/SemanticMediaWiki/SemanticMediaWiki/commit/215599f0fc03274fd4cee9ba0f7162f5a38c031bFixvia CVE List
- github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-vxrm-2g9f-2vqhAdvisoryvia CVE List
- vulncheck.com/advisories/semantic-mediawiki-2.5.0-before-7.3.1-resource-exhaustion-via-set-recurring-eventAdvisoryvia CVE List