Quick answers
- Is CVE-2026-116872 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-116872 being exploited in the wild.
- How severe is CVE-2026-116872?
- High severity, with a CVSS score of 7.5, published 27 October 2026.
- Which products and versions are affected?
- Semantic MediaWiki 3.0.0 before 7.3.1.
- Is there a fix for CVE-2026-116872?
- Yes: fixed in 7.3.1. Until then: Disable or restrict access to Special:Search, or configure an alternative search backend that does not use SMW's ExtendedSearchEngine until upgrading. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-116872 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-116872?
- Check whether you run Semantic MediaWiki at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 7.3.1
Disable or restrict access to Special:Search, or configure an alternative search backend that does not use SMW's ExtendedSearchEngine until upgrading.
Technical details
The TermParser::normalize_compact_form() method uses repeated str_replace() calls across the full search term for each compact in:(...) or has:(...) expression, resulting in quadratic time complexity with respect to input length. An unauthenticated attacker can reach this code by submitting a long search term to Special:Search when the ExtendedSearchEngine backend is configured. The attack exhausts PHP worker threads through CPU consumption without requiring authentication or user interaction.
Affected products
- Semantic MediaWiki Semantic MediaWiki 3.0.0 before 7.3.1
Timeline
- 2026-09-28: disclosed
- 2026-09-28: patched: version 7.3.1 released
- 2026-10-27: advisory