CVE-2026-116878GHSA-wh64-r5x2-vjgf
SemanticMediaWiki: Semantic MediaWiki 2.5.0 before 7.3.1 Resource Exhaustion via Special:PropertyLabelSimilarity
SemanticMediaWiki SemanticMediaWiki
CVSS
8.7HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
What fixes it
- 7.3.1SemanticMediaWikiCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Semantic MediaWiki from 2.5.0 before 7.3.1 contains an uncontrolled resource consumption vulnerability that allows anonymous attackers to force quadratic computation by supplying a zero limit to Special:PropertyLabelSimilarity. Attackers can send repeated requests with limit=0 to bypass the SQL LIMIT and trigger pairwise similar_text() comparisons, exhausting PHP CPU, memory, and database connections.
Text from CVE List
Affected versions 2
- SemanticMediaWikiaffected: 2.5.0 before 7.3.1CVE List
- SemanticMediaWikiunaffected: 7.3.1CVE List
References 3
- github.com/SemanticMediaWiki/SemanticMediaWiki/commit/15ed8489a4ca142ea5417d0c4403dbbe0a3ee3f5Fixvia CVE List
- github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-wh64-r5x2-vjgfAdvisoryvia CVE List
- vulncheck.com/advisories/semantic-mediawiki-2.5.0-before-7.3.1-resource-exhaustion-via-special-propertylabelsimilarityAdvisoryvia CVE List