CVE-2026-116877: Semantic MediaWiki 2.5.0 before 7.3.1 Resource Exhaustion via #set_recurring_event
Semantic MediaWiki from 2.5.0 before 7.3.1 contains an uncontrolled resource consumption vulnerability that allows low-privilege editors to bypass smwgMaxNumRecurringEvents by supplying a large limit parameter. Attackers can save pages using #setrecurringevent without an end date to generate thousands or millions of date subobjects, exhausting CPU, memory, and database resources.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A low-privilege editor who can save pages containing the #set_recurring_event construct can exploit it. No user interaction is required.
What conditions make an installation vulnerable?
Affected installations are Semantic MediaWiki versions from 2.5.0 before 7.3.1. Exploitation uses a recurring event without an end date and a large limit parameter.
What is the operational impact of exploitation?
An attacker can cause thousands or millions of date subobjects to be generated, exhausting CPU, memory, and database resources. This can result in denial of service.
Does smwgMaxNumRecurringEvents prevent exploitation?
No. The issue allows an attacker to bypass smwgMaxNumRecurringEvents by supplying a large limit parameter.