Executive brief
A vulnerability in the ReportIncident extension for MediaWiki can allow a user to cause a denial-of-service (DoS) condition. By accessing pages with many discussion links, the system performs excessive, unthrottled database queries that can lead to slow page loads or server timeouts. This impacts the availability of the wiki for other users and can strain backend database resources.
Technical details
The ReportIncident extension's integration with DiscussionTools fails to properly cache or throttle database queries during configuration validation. When a page contains numerous DiscussionTools reply links (such as large talk page archives), the extension executes repeated, uncached database queries for every link on the page. An authenticated attacker can exploit this by requesting large pages, leading to resource exhaustion, slow database responses, and RequestTimeoutExceptions. The fix involves skipping these validations during read operations and only performing them during writes. The issue was remediated in the master branch and backported to versions 1.43.7, 1.44.4, and 1.45.2.
Affected products
- Wikimedia Foundation MediaWiki - ReportIncident Extension 1.43.7, 1.44.4, 1.45.2
Timeline
- 2026-01-14: disclosed: Issue reported via Phabricator task T414582
- 2026-01-14: patched: Initial patch merged and task closed as resolved
- 2026-04-07: advisory: CVE-2026-5762 published