Uncontrolled Recursion in Semantic MediaWiki Affects Deeply Nested Queries
CVE-2026-116871
8.7HIGH
What is CVE-2026-116871?
An uncontrolled recursion vulnerability exists in Semantic MediaWiki, impacting versions prior to 7.3.1. This flaw occurs in the LegacyParser::getSubqueryDescription() method, allowing unauthenticated attackers to exploit the action=ask API by submitting deeply nested query elements. As a result, the system can experience significant CPU and memory exhaustion, potentially leading to performance degradation and denial of service. Users are advised to update to the latest version to mitigate this risk.
Affected Version(s)
SemanticMediaWiki 3.0.0 < 7.3.1
SemanticMediaWiki 7.3.1