Semantic MediaWiki 3.0.0 before 7.3.1 contains an uncontrolled recursion vulnerability in LegacyParser::getSubqueryDescription() that processes nested query tokens before depth limits apply. Unauthenticated attackers can submit deeply nested query elements to the action=ask API to consume substantial CPU and memory, tying up request workers.
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
Semantic MediaWiki versions before 7.3.1 contain a critical uncontrolled recursion flaw in the LegacyParser::getSubqueryDescription() function that fails to enforce depth limits before processing nested query tokens. This vulnerability allows unauthenticated attackers to exploit the action=ask API by submitting deeply nested query structures, triggering excessive CPU and memory consumption that exhausts request worker threads and causes denial of service. Any organization running affected Semantic MediaWiki instances—particularly those exposed to untrusted networks—faces immediate availability risk, as attackers require no authentication or special privileges to launch attacks.
While this CVE lacks formal MITRE ATT&CK technique mappings, Casky's security skills powered by Claude AI with extended reasoning would detect the attack patterns underlying this vulnerability by analyzing resource exhaustion indicators and recursive call chains. Practitioners using Casky would identify suspicious query submissions to the ask API showing exponential nesting depth, correlate them with sudden CPU/memory spikes, and recognize the pattern as CWE-674 uncontrolled recursion abuse. Security teams would receive findings highlighting the specific parser function involved, the crafted payload characteristics, and remediation guidance—enabling rapid response before worker pools become completely exhausted and legitimate users lose service access.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-116871. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation