Semantic MediaWiki CVE-2026-116872

Requires that the wiki is configured to use SMW\MediaWiki\Search\ExtendedSearchEngine (the SMWSearch backend) as its search engine - this is the decisive, non-default precondition; wikis on the default MediaWiki search are not affected. The attacker also needs the server to accept a request body of roughly 104 KB (the demonstrated term size using ~8,000 compact expressions). No authentication is required because public Special:Search is reachable anonymously (PR:N confirmed by the CVSS vector). Limiting factors defenders can lean on: the extended search backend must be explicitly enabled, web-server or PHP request-size/time limits may blunt or prevent the attack, and the demonstrated effect is CPU time in individual workers rather than a proven full-service outage.

Signals point to a genuine but bounded availability risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, availability-only VA:H, score 8.7) describes a remote, unauthenticated, low-complexity denial-of-service against the vulnerable system with no confidentiality or integrity impact - consistent with the CWE-407 algorithmic-complexity root cause. The vendor's VA:H appears optimistic relative to the advisory's own findings: VulnCheck explicitly states it demonstrated 'disproportionate CPU time in a PHP request worker' but did NOT demonstrate a worker crash or service-wide outage, and notes web-server request limits may affect exploitability - so the realistic worst case is worker starvation under concurrency rather than a confirmed full outage. No EPSS score and no CISA KEV entry are provided (absence of KEV means no confirmed active exploitation), and the PoC is a parser-only reproduction rather than a validated end-to-end remote exploit. The vuln.today decision label is 'this_week', not act_now/emergency. Net: a real, patch-this-week availability issue that is materially gated by a non-default configuration (the extended search engine must be enabled), not a high-CVSS-but-illusory finding, but also not an actively-exploited emergency. Key caveat to verify: exploitation is only possible when SMW's ExtendedSearchEngine/SMWSearch backend is configured, which the raw network-vector score does not reflect.

On a public wiki that uses Semantic MediaWiki's extended search backend, an anonymous attacker sends a form POST to index.php?title=Special:Search with a ~104 KB 'search' value packed with thousands of distinct in:(...)/has:(...) compact expressions. TermParser::normalize_compact_form() rescans and copies the whole term once per match, so parsing cost grows quadratically and ties up a PHP search worker; repeated concurrent requests can consume the available workers. A public PoC reference exists (a bounded parser-only reproduction in the GHSA advisory); it is not verified as working end-to-end remote exploit code.