CVE-2026-116871 — Vulnerability intelligence

semantic-mediawiki — semantic mediawiki

Published: 2026-10-27T11:17:28.813

CVSS

8.7

CISA KEV

Not listed; not proof of no exploitation

Original source text (not a translation)

Semantic MediaWiki 3.0.0 before 7.3.1 contains an uncontrolled recursion vulnerability in LegacyParser::getSubqueryDescription() that processes nested query tokens before depth limits apply. Unauthenticated attackers can submit deeply nested query elements to the action=ask API to consume substantial CPU and memory, tying up request workers.

Sources

• CVE-2026-116871
• Patch
• Patch
• Exploit, Vendor Advisory
• Third Party Advisory