CVE-2026-116878 Semantic MediaWiki 2.5.0 before 7.3.1 Resource Exhaustion via Special:PropertyLabelSimilarity
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-116878?
CVE-2026-116878 is a high-severity vulnerability in SemanticMediaWiki, published on 27 Oct 2026.
Official description
Semantic MediaWiki from 2.5.0 before 7.3.1 contains an uncontrolled resource consumption vulnerability that allows anonymous attackers to force quadratic computation by supplying a zero limit to Special:PropertyLabelSimilarity. Attackers can send repeated requests with limit=0 to bypass the SQL LIMIT and trigger pairwise similar_text() comparisons, exhausting PHP CPU, memory, and database connections.
Weakness: CWE-400
Which versions are affected by CVE-2026-116878?
How do I fix CVE-2026-116878?
No fix has been published for CVE-2026-116878 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-116878 being exploited?
There is no known exploitation of CVE-2026-116878 in the wild and no public exploit code.
Sources
Also known as GHSA-wh64-r5x2-vjgf, GHSA-xjgm-6w2q-3jqg.