Vulnerability · Published Oct 27, 2026 · Assigned by VulnCheck
CVE-2026-116878Semantic MediaWiki 2.5.0 before 7.3.1 Resource Exhaustion via Special:PropertyLabelSimilarity
High 7.5
In plain English
A high-severity uncontrolled resource consumption in SemanticMediaWiki from SemanticMediaWiki. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).
Official description
Semantic MediaWiki from 2.5.0 before 7.3.1 contains an uncontrolled resource consumption vulnerability that allows anonymous attackers to force quadratic computation by supplying a zero limit to Special:PropertyLabelSimilarity. Attackers can send repeated requests with limit=0 to bypass the SQL LIMIT and trigger pairwise similar_text() comparisons, exhausting PHP CPU, memory, and database connections.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SemanticMediaWiki | SemanticMediaWiki | 2.5.0 – before 7.3.1 |
Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- GitHub Security Advisory (GHSA-wh64-r5x2-vjgf) vendor-advisory
- https://github.com/SemanticMediaWiki/SemanticMediaWiki/commit/15ed8489a4ca142ea5417d0c4403dbbe0a3ee3f5 patch
- VulnCheck Advisory: Semantic MediaWiki 2.5.0 before 7.3.1 Resource Exhaustion via Special:PropertyLabelSimilarity third-party-advisory