CVE-2026-116877

EUVD-2026-110705
Semantic MediaWiki from 2.5.0 before 7.3.1 contains an uncontrolled resource consumption vulnerability that allows low-privilege editors to bypass smwgMaxNumRecurringEvents by supplying a large limit parameter. Attackers can save pages using #set_recurring_event without an end date to generate thousands or millions of date subobjects, exhausting CPU, memory, and database resources.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/SemanticMediaWiki/SemanticMediaWiki/commit/215599f0fc03274fd4cee9ba0f7162f5a38c031b
https://github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-vxrm-2g9f-2vqh
https://www.vulncheck.com/advisories/semantic-mediawiki-2.5.0-before-7.3.1-resource-exhaustion-via-set-recurring-event