Semantic MediaWiki: Uncontrolled recursion in query parser leads to denial of service
Summary
Semantic MediaWiki (SMW), an extension for MediaWiki, contains an uncontrolled recursion flaw in the legacy query parser behind the action=ask API. Nested query elements are processed before depth limits apply. An unauthenticated attacker can submit deeply nested queries to consume substantial CPU and memory and tie up request workers, causing availability loss on the wiki.
Affected
- Semantic MediaWiki 3.0.0 up to but excluding 7.3.1
- Affected component: LegacyParser (action=ask API)
Fixed in
- Upgrade to Semantic MediaWiki 7.3.1 or later
Workaround
- No vendor-stated workaround known.
- Interim option (not from a vendor source): restrict or rate-limit access to api.php and action=ask at the reverse proxy or WAF. Test any change first.
Exploitation
- No known exploitation in the wild.
- Not listed in CISA KEV.
- No public proof-of-concept found at the time of research.
Our recommendation
- Identify all wikis running Semantic MediaWiki and check whether the version is 3.0.0 to 7.2.x.
- Upgrade internet-facing wikis to Semantic MediaWiki 7.3.1 or later.
- Consider restricting or rate-limiting the action=ask API until the upgrade is done.
- Monitor PHP worker saturation and response times for signs of abuse.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulnCheck advisory: Semantic MediaWiki uncontrolled recursion via Special:Ask www.vulncheck.com
- GitHub security advisory GHSA-f8vw-wvm6-h2qq github.com
- Fix commit 7564920 (SemanticMediaWiki) github.com
- Fix commit e642f38 (SemanticMediaWiki) github.com
- VulDB entry 427119 vuldb.com
- OSV record CVE-2026-116871 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 00:02.
Original description (NVD)
Semantic MediaWiki 3.0.0 before 7.3.1 contains an uncontrolled recursion vulnerability in LegacyParser::getSubqueryDescription() that processes nested query tokens before depth limits apply. Unauthenticated attackers can submit deeply nested query elements to the action=ask API to consume substantial CPU and memory, tying up request workers.
NVD references (4)
- https://github.com/SemanticMediaWiki/SemanticMediaWiki/commit/756492002752f937a9e115e14330b1181bd8c60c
- https://github.com/SemanticMediaWiki/SemanticMediaWiki/commit/e642f38c708dee7da5e885b8d40be8ffc56f3e87
- https://github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-f8vw-wvm6-h2qq
- https://www.vulncheck.com/advisories/semantic-mediawiki-3.0.0-before-7.3.1-uncontrolled-recursion-via-special…
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.