PT-2026-126332

CVE-2026-116871

Published

2026-10-27

Updated

2026-10-27

Description by

CVSS 4.0

8.7

High

MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Semantic MediaWiki versions 3.0.0 through 7.3.0

Description An uncontrolled recursion issue exists in the LegacyParser::getSubqueryDescription() function, which processes nested query tokens before depth limits are applied. Unauthenticated attackers can exploit this by submitting deeply nested query elements to the 'action=ask' API endpoint, leading to excessive CPU and memory consumption that can exhaust request workers.

Recommendations Update Semantic MediaWiki to version 7.3.1 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-674: Uncontrolled Recursion

Related identifiers

CVE-2026-116871