The vulnerability is an infinite loop in the GrowthExperiments Extension of MediaWiki caused by an unreachable exit condition. The loop can run indefinitely, consuming system resources until the job is manually terminated. This uncontrolled execution can also be leveraged through Time‑of‑Check to Time‑of‑Use race conditions, allowing an adversary to exploit timing gaps during job processing. Such behavior can interrupt normal operation and potentially expose application state changes to unintended consumers.

The affected product is the GrowthExperiments Extension maintained by the Wikimedia Foundation for MediaWiki. No specific release numbers are listed; the issue is present in all branches prior to the fix that was implemented only on the master branch.

The vulnerability scores a CVSS of 6.9, indicating moderate severity, and has an EPSS below 1%, meaning that exploitation probability is very low. It is not included in the CISA KEV catalog. The likely attack vector is through any user who can initiate the GrowthExperiments job via the MediaWiki interface or API, allowing the attacker to induce an infinite loop and possibly trigger timing-based side effects. While the theoretical impact could be service disruption or denial of service, real‑world exploitation would require the attacker to trigger the job and observe its effects, which is a low‑to‑moderate risk scenario for typical deployments.