CVE-2026-116877 in Semantic MediaWiki
Summary
by MITRE • 10/27/2026
Semantic MediaWiki from 2.5.0 before 7.3.1 contains an uncontrolled resource consumption vulnerability that allows low-privilege editors to bypass smwgMaxNumRecurringEvents by supplying a large limit parameter. Attackers can save pages using #set_recurring_event without an end date to generate thousands or millions of date subobjects, exhausting CPU, memory, and database resources.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/27/2026
The vulnerability identified in Semantic MediaWiki versions ranging from 2.5.0 up to but not including 7.3.1 represents a critical uncontrolled resource consumption flaw that undermines the integrity and availability of wiki instances relying on this extension for complex data management. This security issue specifically targets the recurring event functionality, which is designed to allow users to define events that repeat over time by generating multiple date subobjects based on specified parameters. The core technical failure lies in the insufficient validation and enforcement of configuration limits when processing these recurring definitions. Specifically, the system fails to properly restrict or sanitize the limit parameter supplied during the creation or modification of a recurring event via the #set_recurring_event parser function. This oversight allows low-privilege editors, who typically have restricted permissions within the wiki environment, to bypass the smwgMaxNumRecurringEvents configuration directive that is intended to cap the number of generated instances for performance and stability reasons.
From an operational perspective, this flaw enables a denial-of-service scenario where malicious actors can exhaust server resources by crafting pages with recurring events that lack an end date while specifying an excessively large limit value. When such a page is saved or rendered, the system attempts to generate thousands or even millions of individual date subobjects in the database and memory space. This massive generation process consumes significant CPU cycles for calculation and processing, depletes available RAM as these objects are instantiated, and places immense strain on the underlying database through excessive write operations and storage allocation. The impact is not merely a slowdown but can lead to complete service unavailability, affecting all users of the wiki platform by rendering it inaccessible due to resource exhaustion. This type of attack vector exploits the trust placed in user input within collaborative environments where content creation is encouraged without rigorous automated validation against system limits.
In terms of industry standard classifications, this vulnerability aligns with CWE-400, which describes uncontrolled resource consumption, a category often associated with denial-of-service conditions resulting from improper handling of external inputs that trigger excessive processing or storage requirements. Furthermore, the exploitation technique relates to ATT&CK tactic T1496, Resource Hijacking, where attackers leverage compromised resources for disruptive purposes rather than traditional cryptomining, although in this specific context, the primary goal is disruption through resource exhaustion rather than computational theft. The lack of an end date combined with a high limit parameter creates a scenario akin to infinite loops or excessive recursion effects within the application logic, leading to sustained system degradation until manual intervention or service restart occurs.
Mitigation strategies for this vulnerability involve immediate patching to version 7.3.1 or later where these input validation checks have been strengthened. Administrators should ensure that all instances of Semantic MediaWiki are updated promptly to close this gap in resource management logic. In environments where upgrading is not immediately feasible, defensive measures include implementing strict rate limiting on page save operations and monitoring for unusual spikes in database write activity associated with recurring event definitions. Additionally, enforcing stricter permissions so that only high-privilege administrators can define or modify complex data structures involving large-scale object generation can serve as a compensating control to prevent low-privilege users from triggering the flaw. Regular auditing of configuration settings related to smwgMaxNumRecurringEvents and ensuring they are correctly applied during runtime execution is also essential for maintaining system stability against such resource exhaustion attacks.