CVE-2026-126562: Semantic MediaWiki 3.0.0 before 7.4.1 Uncontrolled Recursion via ElasticStore ConceptDescriptionInterpreter

Q: Who can exploit this issue?

An attacker needs page-edit rights in a vulnerable Semantic MediaWiki installation. They can create concept pages that reference each other indirectly, bypassing detection that only handles direct self-references.

Q: What actions trigger the denial of service condition?

Viewing an affected concept page, running Special:Ask, or submitting an api.php action=ask query can trigger recursive processing. The recursion can exhaust PHP memory or stack resources, causing availability impact.

Q: Which versions are affected?

Semantic MediaWiki versions from 3.0.0 before 7.4.1 are affected. Version 7.4.1 is identified as the fixed release.

Published Nov 11, 2026

Updated

Semantic MediaWiki 3.0.0 before 7.4.1 contains an uncontrolled recursion vulnerability in the ElasticStore ConceptDescriptionInterpreter that only detects directly self-referencing concepts. Users with page-edit rights can create mutually referencing concept pages, causing concept page views, Special:Ask, or api.php action=ask queries to exhaust PHP memory or stack.

Affected Software

1 affected component

Semantic MediaWiki Semantic MediaWiki>=3.0.0<7.4.1

Event History

Nov 11, 2026

CVE Published

via MITRE·02:35 AM

Data Sourced

via MITRE·02:35 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs page-edit rights in a vulnerable Semantic MediaWiki installation. They can create concept pages that reference each other indirectly, bypassing detection that only handles direct self-references.

What actions trigger the denial of service condition?

Viewing an affected concept page, running Special:Ask, or submitting an api.php action=ask query can trigger recursive processing. The recursion can exhaust PHP memory or stack resources, causing availability impact.

Which versions are affected?