Semantic MediaWiki CVE-2026-116877

The attacker needs permission to edit a page that will be parsed (a low-privilege editor account suffices; no SMW administrator right is required). The exact trigger is a #set_recurring_event parser function call supplying a large caller-controlled limit parameter WITH the end date omitted - in that no-end branch the configured smwgMaxNumRecurringEvents cap is never consulted, so the loop runs to the attacker's count (e.g. limit=2000 yields 2001 subobjects against a default max of 500). Affected: SemanticMediaWiki >=2.5.0 before 7.3.1 (runtime-confirmed 7.3.0 through 7.3.1-alpha). Limiting factors: requires edit rights on a parsed page, so PR:N applies only where anonymous editing is enabled; where editing requires a registered account the realistic privilege is PR:L; impact is availability only, with no data disclosure or modification.

This is a server-side availability-only flaw (CWE-770/CWE-400). The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H, score 8.7) rates it High, driven entirely by VA:H with no confidentiality or integrity impact. However, the PR:N (unauthenticated) metric conflicts with the mechanism: both the description ('low-privilege editors') and the GHSA advisory state the attacker needs permission to edit a parsed page, and the advisory explicitly scores it PR:L (6.5) with PR:N (7.5) applying ONLY if anonymous editing is enabled - so the official 8.7 assumes an anonymous-edit configuration. Treat authentication as configuration-dependent, not unauthenticated by default. No EPSS score is provided and the CVE is not in CISA KEV, so there is no signal of widespread or active exploitation; a working proof-of-concept is embedded in the GHSA advisory (with observed output: generated=2001 against a configured max of 500) but has not been verified as a standalone published exploit. The vuln.today Decision label is 'this_week', consistent with a patchable, repeatable DoS rather than an emergency. Net: a genuine but availability-limited priority - remediate this week - whose real-world severity depends heavily on whether anonymous or low-trust editing is permitted on the wiki.

A user with ordinary page-edit rights (or any anonymous user, if anonymous editing is enabled) saves a page containing a #set_recurring_event parser function with a large limit value and no end date; because smwgMaxNumRecurringEvents is only enforced in the end-date branch, the parser generates thousands-to-millions of date subobjects in a single parse, exhausting CPU, memory, parser-cache, semantic-store, and database resources. The GHSA advisory includes a working PoC that produced 2,001 subobjects against a 500 ceiling and a ~10s parse at limit=2000 in an isolated fixture; the cost scales directly with the attacker-controlled count and can be repeated.