Threats affecting pkg:github/semanticmediawiki/SemanticMediaWiki

Semantic MediaWiki versions from 3.0.0 up to but not including 7.3.1 contain an algorithmic complexity vulnerability in the TermParser::normalize_compact_form() function. This flaw allows unauthenticated attackers to cause quadratic CPU consumption by submitting long search terms with many distinct in:(...) or has:(...) expressions to Special:Search when the extended search engine is enabled. The vulnerability can exhaust PHP search workers, impacting service availability. A fix is available in version 7.3.1.

Semantic MediaWiki versions 3.0.0 through 7.3.0 contain an uncontrolled recursion vulnerability in the LegacyParser::getSubqueryDescription() function. This flaw allows unauthenticated attackers to submit deeply nested query elements via the action=ask API, causing excessive CPU and memory consumption and tying up server request workers. The vulnerability is fixed in version 7.3.1.