CVE-2026-116872
High · 7.5CVSS
7.5
EPSS
0.4%
Published
Oct 27, 2026
CISA due date
—
The record
Semantic MediaWiki from 3.0.0 before 7.3.1 contains an algorithmic complexity vulnerability in TermParser::normalize_compact_form() that allows unauthenticated attackers to cause quadratic CPU consumption. Attackers can submit long search terms with many distinct in:(...) or has:(...) expressions to Special:Search to exhaust PHP search workers when the extended search engine is enabled.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-62160 Daptin is a GraphQL/JSON-API headless CMS. CWE-407
- CVE-2026-87768 DateTime::Lite versions before 0.8.1 for Perl allow CPU exhaustion via a per-day loop… CWE-407
- CVE-2026-119196 pyasn1 is a generic ASN.1 library for Python. CWE-407
- CVE-2026-119194 pyasn1 is a generic ASN.1 library for Python. CWE-407
- CVE-2026-119195 pyasn1 is a generic ASN.1 library for Python. CWE-407
- CVE-2026-119197 pyasn1 is a generic ASN.1 library for Python. CWE-407
- CVE-2019-25781 Python-Markdown 3.0 through 3.11.2 contains an algorithmic complexity vulnerability in… CWE-407
- CVE-2026-118694 python-markdown2 through 2.5.5 contains a denial of service vulnerability that allows… CWE-407