Description
An issue was discovered in MediaWiki through 1.38.1. The lemma length of a Wikibase lexeme is currently capped at a thousand characters. Unfortunately, this length is not validated, allowing much larger lexemes to be created, which introduces various denial-of-service attack vectors within the Wikibase and WikibaseLexeme extensions. This is related to Special:NewLexeme and Special:NewProperty.
Remediation
References
Related Vulnerabilities
WordPress Plugin Blue Wrench Video Widget Cross-Site Request Forgery (1.0.5)
WebLogic CVE-2023-21956 Vulnerability (CVE-2023-21956)
WebLogic Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2021-40690)
PostgreSQL Heap-based Buffer Overflow Vulnerability (CVE-2026-14670)
WordPress Plugin Backup Migration Information Disclosure (1.3.5)