Semantic MediaWiki: Uncontrolled recursion via concept descriptions leads to DoS
Summary
Semantic MediaWiki 3.0.0 before 7.4.1 contains an uncontrolled recursion flaw in the ElasticStore ConceptDescriptionInterpreter, which only detects concepts that reference themselves directly. A user with page-edit rights can create mutually referencing concept pages. Viewing such concept pages, running Special:Ask or calling api.php action=ask then exhausts PHP memory or stack, causing a denial of service.
Affected
- Semantic MediaWiki 3.0.0 before 7.4.1 (per the CNA record; earlier versions not confirmed)
- Condition: attacker needs a logged-in account with page-edit rights
Fixed in
- Semantic MediaWiki 7.4.1
Workaround
Unknown.
Exploitation
- No evidence of exploitation in the wild at the time of writing.
- No public proof of concept found.
Our recommendation
- Upgrade Semantic MediaWiki to version 7.4.1 in the next maintenance window, prioritising public or open-editing wikis.
- Until the upgrade is done, restrict page-edit rights to trusted users.
- Check for concept pages that reference each other and monitor for PHP memory or timeout errors.
- Verify the affected version range against the GitHub security advisory GHSA-jwx8-mm92-gv95.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub release 7.4.1 github.com
- GitHub security advisory GHSA-jwx8-mm92-gv95 github.com
- GitHub fix commit 35d8f8c github.com
- VulnCheck advisory www.vulncheck.com
- VulDB CVE-2026-126562 vuldb.com
- OffSeq radar entry radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 18:11.
Original description (NVD)
Semantic MediaWiki 3.0.0 before 7.4.1 contains an uncontrolled recursion vulnerability in the ElasticStore ConceptDescriptionInterpreter that only detects directly self-referencing concepts. Users with page-edit rights can create mutually referencing concept pages, causing concept page views, Special:Ask, or api.php action=ask queries to exhaust PHP memory or stack.
NVD references (6)
- https://github.com/SemanticMediaWiki/SemanticMediaWiki/blob/7.4.0/src/Elastic/QueryEngine/DescriptionInterpre…
- https://github.com/SemanticMediaWiki/SemanticMediaWiki/commit/35d8f8c9c7b48a476751ca0b795b78b648756828
- https://github.com/SemanticMediaWiki/SemanticMediaWiki/releases/tag/7.4.1
- https://github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-jwx8-mm92-gv95
- https://www.vulncheck.com/advisories/semantic-mediawiki-3.0.0-before-7.4.1-uncontrolled-recursion-via-elastic…
- https://github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-jwx8-mm92-gv95
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.