Semantic MediaWiki versions 2.5.0 through 7.3.0 contain an uncontrolled resource consumption flaw. The #set_recurring_event parser function can be used without an end date to generate an unbounded number of date subobjects. The attacker can supply a large limit parameter to bypass the smwgMaxNumRecurringEvents setting, causing the system to create thousands or millions of subobjects. This leads to exhaustion of CPU, memory, and database resources, effectively disabling the wiki for legitimate users.

The affected product is Semantic MediaWiki, an extension for MediaWiki. Vulnerable releases include all versions from 2.5.0 up to but not including 7.3.1. Organizations using these versions without the patch should treat the system as compromised.

The CVSS score of 8.7 indicates a high impact vulnerability. The EPSS score is not available, so the current statistical likelihood of exploitation is unknown, but the fact that the flaw can be triggered by any low‑privilege editor makes it broadly usable in environments where editors are not tightly controlled. The vulnerability is not listed in the CISA KEV catalog, meaning no known public exploits are reported yet. Attackers could target any site that accepts user edits, and the resource exhaustion could render the wiki unusable.