GHSA-f8vw-wvm6-h2qq: Semantic MediaWiki 3.0.0 before 7.3.1 Uncontrolled Recursion via Special:Ask

Published Oct 27, 2026

Updated

Semantic MediaWiki 3.0.0 before 7.3.1 contains an uncontrolled recursion vulnerability in LegacyParser::getSubqueryDescription() that processes nested query tokens before depth limits apply. Unauthenticated attackers can submit deeply nested query elements to the action=ask API to consume substantial CPU and memory, tying up request workers.

Event History

Oct 27, 2026

CVE Published

via OSV·10:23 AM

Data Sourced

via OSV·10:23 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

Any unauthenticated remote attacker able to send requests to the action=ask API can exploit it. No privileges or user interaction are required.

What is the practical impact on an affected site?

Deeply nested query elements can consume substantial CPU and memory and tie up request workers. This can reduce availability of the affected Semantic MediaWiki instance.

Which versions are affected?

Semantic MediaWiki versions from 3.0.0 before 7.3.1 are affected. Version 7.3.1 is not included in the affected range.

How can I tell whether my deployment is exposed?

A deployment is exposed if it runs an affected version and makes the action=ask API reachable by untrusted users. The vulnerable processing occurs when nested query tokens are handled by LegacyParser::getSubqueryDescription().

GHSA-f8vw-wvm6-h2qq: Semantic MediaWiki 3.0.0 before 7.3.1 Uncontrolled Recursion via Special:Ask

Event History

Frequently Asked Questions

Who can exploit this issue?

What is the practical impact on an affected site?

Which versions are affected?

How can I tell whether my deployment is exposed?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is the practical impact on an affected site?

Which versions are affected?

How can I tell whether my deployment is exposed?