CVE-2026-116872
Received Received - Intake

Semantic MediaWiki Algorithm Complexity Flaw Enables DoS

Publication date: 2026-10-27

Last updated on: 2026-10-27

Assigner: VulnCheck

Description
Semantic MediaWiki from 3.0.0 before 7.3.1 contains an algorithmic complexity vulnerability in TermParser::normalize_compact_form() that allows unauthenticated attackers to cause quadratic CPU consumption. Attackers can submit long search terms with many distinct in:(...) or has:(...) expressions to Special:Search to exhaust PHP search workers when the extended search engine is enabled.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-27
Last Modified
2026-10-27
Generated
2026-10-27
AI Q&A
2026-10-27
EPSS Evaluated
N/A
NVD
CVE-2026-116872
EUVD
EUVD-2026-110700

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
SemanticMediaWiki SemanticMediaWiki 3.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-407 An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Denial of Service (DoS) flaw in Semantic MediaWiki versions 3.0.0 to 7.3.0. It involves an inefficient algorithm in TermParser::normalize_compact_form() that causes quadratic CPU consumption when processing long search terms with many distinct in:(...) or has:(...) expressions. Attackers can exploit this by submitting specially crafted queries to Special:Search, overwhelming PHP search workers when the extended search engine is enabled.

Detection Guidance

Monitor for unusually high CPU usage on servers running Semantic MediaWiki versions 3.0.0 to 7.3.0 during search operations. Check for excessive POST requests to Special:Search with long queries containing many 'in:(...)' or 'has:(...)' expressions. Use tools like top, htop, or system monitoring dashboards to detect abnormal resource consumption.

Impact Analysis

This vulnerability can lead to excessive CPU usage and resource exhaustion on the server hosting Semantic MediaWiki. It may cause slow performance, unresponsiveness, or temporary downtime of the wiki's search functionality. Systems with limited resources are particularly vulnerable to disruption.

Mitigation Strategies

Upgrade Semantic MediaWiki to version 7.3.1 or later to apply the patch that fixes the algorithmic complexity issue. If immediate upgrade is not possible, disable the extended search engine backend or restrict access to Special:Search functionality until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116872. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart