# CVE-2026-116871 - Semantic MediaWiki 3.0.0 before 7.3.1 Uncontrolled Recursion via Special:Ask

DevFeed: [CVE-2026-116871 - Semantic MediaWiki 3.0.0 before 7.3.1 Uncontrolled Recursion via Special:Ask](<https://devfeed.tech/articles/cve-2026-116871-semantic-mediawiki-3-0-0-before-7-3-1-uncontrolled-recursion-via-special-ask-102070.md>)

Original publisher: [Read original article](<https://cvefeed.io/vuln/detail/CVE-2026-116871>)

Author: CVEFEED.io; vulncheck.com

Published: 2026-10-27T11:17:28Z

Content type: news

Language: en

Sources: [Latest High/Critical Vulnerabilitiy Feed](<https://devfeed.tech/sources/latest-high-critical-vulnerabilitiy-feed.md>)

Topics: [MediaWiki](<https://devfeed.tech/topics/mediawiki.md>)

Tags: [2026](<https://devfeed.tech/tags/2026.md>), [api](<https://devfeed.tech/tags/api.md>), [cpu](<https://devfeed.tech/tags/cpu.md>), [cve](<https://devfeed.tech/tags/cve.md>), [cve-2026-116871](<https://devfeed.tech/tags/cve-2026-116871.md>), [memory](<https://devfeed.tech/tags/memory.md>), [nested](<https://devfeed.tech/tags/nested.md>), [recursion](<https://devfeed.tech/tags/recursion.md>), [semantic-mediawiki](<https://devfeed.tech/tags/semantic-mediawiki.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>), [workers](<https://devfeed.tech/tags/workers.md>)

## AI overview

Unauthenticated attackers can send deeply nested query elements to Semantic MediaWiki's `action=ask` API, triggering uncontrolled recursion in `LegacyParser::getSubqueryDescription()` before depth limits apply. The resulting CPU and memory use can tie up request workers. The description identifies versions 3.0.0 before 7.3.1 as affected.

## Source excerpt

CVE ID :CVE-2026-116871 Published : Oct. 27, 2026, 11:17 a.m. | 1 hour, 28 minutes ago Description :Semantic MediaWiki 3.0.0 before 7.3.1 contains an uncontrolled recursion vulnerability in LegacyParser::getSubqueryDescription() that processes nested query tokens before depth limits apply. Unauthenticated attackers can submit deeply nested query elements to the action=ask API to consume substantial CPU and memory, tying up request workers. Severity: 8.7 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...