CVE-2025-61766
BaseFortify
Publication date: 2025-10-06
Last updated on: 2025-10-08
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| weirdgloop | mediawiki-extensions-bucket | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-674 | The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs in the MediaWiki extension 'Bucket' prior to version 1.0.0 when a user queries a repeated field using the '!=' operator. The code triggers infinite recursion between two internal functions, causing PHP's call stack or memory limits to be exceeded. This results in a denial of service by making the page inaccessible. The issue is due to uncontrolled recursion in the code handling the '!=' operator on repeated fields. [1]
How can this vulnerability impact me? :
The vulnerability can lead to a denial of service (DoS) condition by exhausting PHP's call stack or memory resources when a crafted query using the '!=' operator on repeated fields is executed. This can make the affected MediaWiki pages inaccessible, disrupting availability of the service. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for PHP errors or crashes related to call stack limits or excessive memory consumption when queries using the '!=' operator on repeated fields in the Bucket extension are executed. Specifically, you can look for logs indicating PHP fatal errors due to maximum function nesting level or memory exhaustion. Additionally, testing with Lua module queries such as `bucket('test').select('testfield').where('testfield', '!=', 'abc').run()` on a system running a vulnerable version (prior to 1.0.0) can reproduce the issue. There are no specific network commands provided, but checking MediaWiki logs and PHP error logs for such symptoms is recommended. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade the MediaWiki Bucket extension to version 1.0.0 or later, which contains the patch fixing the infinite recursion issue. If upgrading is not immediately possible, avoid using the '!=' comparator on repeated fields in Bucket queries to prevent triggering the recursion. Monitoring and restricting user queries that use this operator can also help mitigate the risk until the patch is applied. [1, 2]