Semantic MediaWiki CVE-2026-116871

Requires that the wiki expose the public Special:Ask / action=ask API (a common default on public Semantic MediaWiki installs) and accept a POST body of roughly 120 KB carrying deeply nested <q>...</q> tokens; no authenticated account is needed on a public wiki (PR:N). Exploitation is LIMITED by: deployment-level POST/request body-size caps that may block the large payload, and installations that restrict or disable the ask API. After patching, the new smwgQMaxDepth guard (default 4) in LegacyParser halts descent and returns a controlled 'smw-query-nesting-level-exceeded' error, so only pre-7.3.1 versions in the >=3.0.0 range are affected. The advisory did not confirm a full service outage, so realistic impact is worker CPU/memory consumption and capacity degradation rather than a guaranteed crash.

This is a genuine but bounded availability risk, not a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms a remote, unauthenticated, low-complexity trigger with no user interaction, and impact is strictly availability (VA:H; VC:N/VI:N) - consistent with CWE-674 uncontrolled recursion causing resource exhaustion, with no confidentiality or integrity exposure. No EPSS score and no CISA KEV entry were supplied, so there is no evidence of active or widespread exploitation; the vuln.today Decision label is 'this_week' (not act_now/emergency), and the vendor patch (fixed in 7.3.1) is available, which together argue for prompt but routine patching rather than crisis response. The signals are internally consistent (high-severity network DoS with a fix) but the real-world impact is softened by the reporter's own caveat: the GHSA harness demonstrated per-worker CPU/memory consumption (up to ~3.69s and ~36 MiB at depth 20,000 within a 64 MiB limit) but did NOT establish a production worker crash or service-wide outage, and deployment POST body-size limits (the PoC needs ~120 KB) may reduce reachability. The 8.7 base score therefore somewhat overstates confirmed impact relative to what was actually demonstrated - treat this as a credible single-request/amplifiable DoS against public wikis, prioritized below any code-execution or data-exposure issue.

An unauthenticated attacker sends a single ~120 KB POST to a public wiki's action=ask API containing a deeply nested <q>...</q> query (e.g. 20,000 levels). LegacyParser::getSubqueryDescription() recurses on every opening token before the smwgQMaxDepth/size pruning runs, so one request ties up a PHP worker's CPU and memory; repeating this concurrently can degrade capacity. A public PoC reference exists in the GHSA advisory (a shell/curl command plus a bounded local harness); it is not verified as working exploit code against a live service, and the low CVSS attack complexity (AC:L, no auth, no interaction) means crafting the request is trivial.