The ReportIncident Extension contains a flaw that allows unbounded allocation of server resources, leading to a denial‑of‑service condition. This uncontrolled memory consumption is identified as CWE‑770.

Vulnerable versions of the MediaWiki ReportIncident Extension distributed by the Wikimedia Foundation prior to the latest master branch patch are affected. The patch is only available on the master branch, meaning older stable releases remain at risk.

The CVSS score of 5.3 rates the vulnerability as moderate while the EPSS score of less than 1 % indicates a low likelihood of exploitation. Based on the description, the likely attack vector involves sending repeated HTTP requests to the ReportIncident endpoints, exhausting server resources. The vulnerability is not listed in the CISA KEV catalog and no public exploits are known, but the absence of throttling presents a clear path for a determined attacker to disrupt service.