Semantic MediaWiki: Uncontrolled resource consumption via #set_recurring_event
Summary
Semantic MediaWiki extension for MediaWiki from 2.5.0 before 7.3.1 does not enforce the smwgMaxNumRecurringEvents limit when a recurring event has no end date and a large limit parameter is supplied. An editor with low privileges can save a page that generates thousands or millions of date subobjects, which exhausts CPU, memory and database resources. The impact is limited to availability; confidentiality and integrity are not affected.
Affected
- Semantic MediaWiki 2.5.0 up to but not including 7.3.1 (CNA range)
- The advisory GHSA-vxrm-2g9f-2vqh confirms 7.3.0 through 7.3.1-alpha and gives the range as 7.3.0 to before 7.3.1; VulDB lists up to 7.3.0
Fixed in
- Semantic MediaWiki 7.3.1 (released 28 September 2026)
- Security fixes are only provided in the latest major version; older major versions need an upgrade to 7.3.1
Workaround
Unknown.
- Restrict edit rights to trusted users until the upgrade is applied (own assessment, not from a vendor source)
Exploitation
- Not known to be exploited in the wild (OffSeq; CISA KEV not checked)
- No public proof of concept found; the advisory contains a reproduction script
- Attacker needs an editor account (or anonymous editing enabled)
Our recommendation
- Upgrade Semantic MediaWiki to 7.3.1 and check the MediaWiki core compatibility (1.43 to 1.46)
- Prioritise internet-facing wikis and wikis with self-registration or open editing
- Review edit permissions and monitor for pages with large #set_recurring_event limits and unusual resource usage
- Note: the CVSS 4.0 score of 8.7 assumes no privileges required; the description requires an editor account, so the practical risk depends on who can edit
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-vxrm-2g9f-2vqh github.com
- Fix commit 215599f0fc03274fd4cee9ba0f7162f5a38c031b github.com
- VulnCheck advisory www.vulncheck.com
- VulDB entry 427118 vuldb.com
- OffSeq threat radar CVE-2026-116877 radar.offseq.com
- Strix CVE-2026-116877 www.strix.ai
- Semantic MediaWiki 7.3 release news professional.wiki
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 00:00.
Original description (NVD)
Semantic MediaWiki from 2.5.0 before 7.3.1 contains an uncontrolled resource consumption vulnerability that allows low-privilege editors to bypass smwgMaxNumRecurringEvents by supplying a large limit parameter. Attackers can save pages using #set_recurring_event without an end date to generate thousands or millions of date subobjects, exhausting CPU, memory, and database resources.
NVD references (3)
- https://github.com/SemanticMediaWiki/SemanticMediaWiki/commit/215599f0fc03274fd4cee9ba0f7162f5a38c031b
- https://github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-vxrm-2g9f-2vqh
- https://www.vulncheck.com/advisories/semantic-mediawiki-2.5.0-before-7.3.1-resource-exhaustion-via-set-recurr…
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.