CVE-2026-116872

High

Description

Semantic MediaWiki from 3.0.0 before 7.3.1 contains an algorithmic complexity vulnerability in TermParser::normalize_compact_form() that allows unauthenticated attackers to cause quadratic CPU consumption. Attackers can submit long search terms with many distinct in:(...) or has:(...) expressions to Special:Search to exhaust PHP search workers when the extended search engine is enabled.

SeverityHigh

CVSS7.5

Exploit probability—

ProductSemantic-mediawiki Semantic Mediawiki

PublishedOct 27, 2026

First seenOct 27, 2026

Weakness typeCWE-407CWE-407

How to fix

Update

semantic-mediawiki semantic_mediawiki7.3.1 or later

Patches

github.com/SemanticMediaWiki/SemanticMediaWiki/commit/c2bf1699dec4016e21ce52613152bda799ce87d4

Vendor advisories

github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-j2r2-7qpg-p675

Affected products

Product	Affected versions	Fixed in
semantic-mediawiki semantic_mediawiki	3.0.0 ≤ v < 7.3.1	7.3.1

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.