CVE-2026-116872 in Semantic MediaWiki
Summary
by MITRE • 10/27/2026
Semantic MediaWiki from 3.0.0 before 7.3.1 contains an algorithmic complexity vulnerability in TermParser::normalize_compact_form() that allows unauthenticated attackers to cause quadratic CPU consumption. Attackers can submit long search terms with many distinct in:(...) or has:(...) expressions to Special:Search to exhaust PHP search workers when the extended search engine is enabled.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/27/2026
The vulnerability identified in Semantic MediaWiki versions ranging from 3.0.0 up to, but not including, version 7.3.1 represents a significant algorithmic complexity flaw located within the TermParser::normalize_compact_form() function. This specific component is responsible for processing and normalizing search queries submitted by users through the platform's interface. The core technical issue stems from an inefficient handling of complex query structures, particularly those involving multiple distinct expressions enclosed in parentheses such as in:(...) or has:(...). When these nested or repeated logical constructs are processed, the underlying algorithm exhibits quadratic time complexity relative to the length and complexity of the input string rather than linear growth. This means that as the number of distinct terms increases, the computational resources required do not increase proportionally but instead escalate exponentially, creating a disproportionate load on the server infrastructure.
From an operational perspective, this vulnerability allows unauthenticated attackers to trigger severe performance degradation without requiring any form of authentication or prior access privileges. By submitting specially crafted search queries containing numerous in:(...) or has:(...) expressions via the Special:Search endpoint, an attacker can force the PHP-based search workers into a state of excessive CPU consumption. Since Semantic MediaWiki often relies on background processes to handle complex searches and data indexing, exhausting these resources effectively denies service to legitimate users. The extended search engine, when enabled, is particularly susceptible because it attempts to parse and evaluate every component of the query string in detail. This results in PHP workers becoming unresponsive or crashing due to resource limits being exceeded, thereby disrupting the availability of the wiki platform for all connected clients.
This vulnerability aligns with Common Weakness Enumeration (CWE) category CWE-400, which describes Uncontrolled Resource Consumption, specifically manifesting as a Denial of Service through algorithmic complexity attacks often referred to as ReDoS or quadratic blowup vulnerabilities. In terms of the MITRE ATT&CK framework, this behavior corresponds to techniques associated with Impactful actions that aim to disrupt service availability, such as T1496 Resource Hijacking or more broadly within the impact tactics where an adversary seeks to degrade system performance. The lack of input validation regarding query complexity allows external actors to exploit this logic flaw remotely, making it a critical security concern for any deployment relying on Semantic MediaWiki's advanced search capabilities.
To mitigate this risk, administrators must upgrade their instances of Semantic MediaWiki to version 7.3.1 or later, where the algorithmic inefficiency in TermParser::normalize_compact_form() has been addressed and optimized. For environments that cannot immediately patch due to dependency constraints, implementing web application firewall rules can provide a temporary layer of defense by inspecting incoming POST requests to Special:Search for excessively long query strings or an unusually high count of nested parentheses expressions. Additionally, configuring PHP resource limits such as max_execution_time and memory_limit on the server side can help contain the impact of such attacks by terminating runaway processes before they exhaust all available system resources. Regularly auditing search logs for patterns indicative of this abuse vector is also recommended to detect potential exploitation attempts early in their lifecycle.