CVE-2026-116877
Received Received - Intake

Uncontrolled Resource Consumption in Semantic MediaWiki

Publication date: 2026-10-27

Last updated on: 2026-10-27

Assigner: VulnCheck

Description
Semantic MediaWiki from 2.5.0 before 7.3.1 contains an uncontrolled resource consumption vulnerability that allows low-privilege editors to bypass smwgMaxNumRecurringEvents by supplying a large limit parameter. Attackers can save pages using #set_recurring_event without an end date to generate thousands or millions of date subobjects, exhausting CPU, memory, and database resources.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-27
Last Modified
2026-10-27
Generated
2026-10-27
AI Q&A
2026-10-27
EPSS Evaluated
N/A
NVD
CVE-2026-116877
EUVD
EUVD-2026-110705

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
SemanticMediaWiki SemanticMediaWiki 2.5.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Semantic MediaWiki versions 2.5.0 to 7.3.0. It allows low-privilege editors to bypass the smwgMaxNumRecurringEvents setting by providing a large limit parameter in the #set_recurring_event parser function. Attackers can create recurring events without an end date, generating thousands or millions of date subobjects. This exhausts CPU, memory, and database resources, potentially causing denial-of-service conditions.

Detection Guidance

Monitor for unusually high CPU, memory, or database usage on your Semantic MediaWiki server. Check for pages with excessive recurring events by inspecting the #set_recurring_event parser function usage in wikitext. Look for pages with no end date and very large limit parameters.

Impact Analysis

If exploited, this vulnerability can lead to severe performance degradation or complete system outages. It consumes excessive server resources, making the wiki slow or unresponsive. Organizations hosting Semantic MediaWiki instances may experience downtime, data loss, or increased operational costs due to resource scaling.

Mitigation Strategies

Apply the security fix from commit 215599f0fc03274fd4cee9ba0f7162f5a38c031b to enforce the maximum recurring events limit regardless of end date. Temporarily restrict edit permissions to trusted users until patched. Monitor server resources for abnormal activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116877. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart