CVE-2026-116878
7.5 HIGHpublic exploit availablePublished 2026-10-27 · Updated 2026-10-27
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
Semantic MediaWiki from 2.5.0 before 7.3.1 contains an uncontrolled resource consumption vulnerability that allows anonymous attackers to force quadratic computation by supplying a zero limit to Special:PropertyLabelSimilarity. Attackers can send repeated requests with limit=0 to bypass the SQL LIMIT and trigger pairwise similar_text() comparisons, exhausting PHP CPU, memory, and database connections.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400
Public exploit & PoC references
All references
- https://github.com/SemanticMediaWiki/SemanticMediaWiki/commit/15ed8489a4ca142ea5417d0c4403dbbe0a3ee3f5
- https://github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-wh64-r5x2-vjgf
- https://www.vulncheck.com/advisories/semantic-mediawiki-2.5.0-before-7.3.1-resource-exhaustion-via-special-propertylabelsimilarity
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- HIGHCVE-2025-52290
- HIGHCVE-2026-100137
- HIGHCVE-2026-100138
- HIGHCVE-2026-100139
- HIGHCVE-2026-100242PoC
- MEDIUMCVE-2026-100350PoC
- MEDIUMCVE-2026-100527PoC
- LOWCVE-2026-100542PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.