Algorithmic Complexity Vulnerability in Semantic MediaWiki by Semantic MediaWiki

CVE-2026-116872

What is CVE-2026-116872?

Semantic MediaWiki versions prior to 7.3.1 feature an algorithmic complexity vulnerability within the TermParser::normalize_compact_form() function. This flaw enables unauthenticated attackers to exploit the PHP search workers by sending long search queries with numerous distinct in:(...) or has:(...) expressions to the Special:Search functionality. When the extended search engine is activated, such carefully crafted inputs can lead to excessive CPU consumption, effectively resulting in a Denial of Service condition.

References