This vulnerability (CWE-835) in the Mediawiki GrowthExperiments Extension arises from a loop with an unreachable exit condition, effectively creating an infinite loop. This flaw can be exploited by leveraging Time-of-Check to Time-of-Use (TOCTOU) race conditions. The affected versions include 1.43 through 1.45 and possibly version 0. The remediation has been made only on the master branch, with no official patch or advisory confirming a released fix. The CVSS 4.0 base score is 6.9, indicating medium severity with network attack vector, low complexity, no privileges or user interaction required, and low to medium impacts on confidentiality, integrity, availability, and security scope.

The vulnerability can cause an infinite loop condition in the GrowthExperiments Extension, potentially leading to degraded service or denial of service conditions. The TOCTOU race condition aspect may allow an attacker to exploit timing windows to trigger the infinite loop. There are no reports of active exploitation in the wild. The impact is rated medium severity based on the CVSS score and described effects.

No official patch or remediation level has been confirmed beyond the fix applied on the master branch. Users should monitor the Wikimedia Foundation's advisories for an official patch release. Until then, consider avoiding use of the affected versions or applying the fix from the master branch if feasible. No vendor advisory indicates that no action is required or that the issue is already mitigated.