CVE-2026-116871

{
  "etk_id": "ETK-2026-2749",
  "cve_id": "CVE-2026-116871",
  "display_id": "CVE-2026-116871",
  "ghsa_id": "GHSA-f8vw-wvm6-h2qq",
  "euvd_id": "EUVD-2026-110699",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Uncontrolled recursion in Semantic MediaWiki query parsing",
  "summary": "Semantic MediaWiki versions 3.0.0 through before 7.3.1 are affected by uncontrolled recursion while parsing nested queries. An unauthenticated remote party can cause resource exhaustion and disrupt request handling by reaching the ask API.",
  "mitigation": "Upgrade SemanticMediaWiki to version 7.3.1 or later. Until upgraded, restrict unauthenticated access to the ask API where operationally feasible.",
  "vendor": "SemanticMediaWiki",
  "product": "SemanticMediaWiki",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 3.0.0, < 7.3.1"
      ],
      "ecosystem": "composer",
      "fixed_versions": [
        "7.3.1"
      ],
      "package_name": "mediawiki/semantic-media-wiki",
      "purl": "pkg:composer/mediawiki/semantic-media-wiki"
    }
  ],
  "cwes": [
    674
  ],
  "cvss_score": 8.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 55.59099176666667,
  "t0_at": "2026-10-27T10:23:26.290000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-27T11:48:54.583335+00:00",
      "days": 0.05935524693287037,
      "is_lower_bound": false,
      "measured_at": "2026-10-27T10:23:26.290000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-27T10:23:26.290000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-27T10:23:26.290000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-116871"
    }
  }
}