Semantic MediaWiki: Resource exhaustion via Special:PropertyLabelSimilarity
Summary
Semantic MediaWiki (SMW), an extension for MediaWiki, contains an uncontrolled resource consumption vulnerability (CWE-400) in Special:PropertyLabelSimilarity. A limit value of 0 removes the SQL limit, so the page compares all properties pairwise. Anonymous attackers can send repeated requests to exhaust PHP CPU, memory and database connections, causing a denial of service for the wiki.
Affected
- Semantic MediaWiki 2.5.0 up to but not including 7.3.1 (per CVE record)
- The advisory confirms 7.3.0 and 7.3.1-alpha; VulDB lists up to 7.3.0
- Versions outside this range were not assessed
Fixed in
- Semantic MediaWiki 7.3.1 (fix commit 15ed8489a4ca142ea5417d0c4403dbbe0a3ee3f5)
- SMW 5 and 6 do not receive security fixes; no separate backport is known
Workaround
- No vendor workaround known
- Temporary measure (not verified as sufficient): block or restrict anonymous access to Special:PropertyLabelSimilarity at the web server or reverse proxy, and apply rate limiting
Exploitation
- CISA SSVC: exploitation none, automatable yes, technical impact partial
- No public proof of concept known; not listed in CISA KEV
- No confirmed exploitation in the wild
Our recommendation
- Upgrade Semantic MediaWiki to 7.3.1 or later; check MediaWiki compatibility first
- If the upgrade cannot be done quickly, restrict anonymous access to the special page
- Check whether the wiki is reachable from the internet and monitor for unusual request volumes or PHP and database resource spikes
- Upgrading to 7.3.1 also covers CVE-2026-116877 and CVE-2026-116876 according to the research notes
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-wh64-r5x2-vjgf github.com
- Fix commit 15ed8489a4ca142ea5417d0c4403dbbe0a3ee3f5 github.com
- VulnCheck advisory www.vulncheck.com
- VulDB entry 427112 vuldb.com
- Professional.wiki: Semantic MediaWiki 7.3 release professional.wiki
- Threatint CVE summary cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 00:01.
Original description (NVD)
Semantic MediaWiki from 2.5.0 before 7.3.1 contains an uncontrolled resource consumption vulnerability that allows anonymous attackers to force quadratic computation by supplying a zero limit to Special:PropertyLabelSimilarity. Attackers can send repeated requests with limit=0 to bypass the SQL LIMIT and trigger pairwise similar_text() comparisons, exhausting PHP CPU, memory, and database connections.
NVD references (3)
- https://github.com/SemanticMediaWiki/SemanticMediaWiki/commit/15ed8489a4ca142ea5417d0c4403dbbe0a3ee3f5
- https://github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-wh64-r5x2-vjgf
- https://www.vulncheck.com/advisories/semantic-mediawiki-2.5.0-before-7.3.1-resource-exhaustion-via-special-pr…
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.