CVE-2026-5762

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-5762", "assignerOrgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "state": "PUBLISHED", "assignerShortName": "wikimedia-foundation", "dateReserved": "2026-04-07T18:21:15.769Z", "datePublished": "2026-04-07T18:42:35.336Z", "dateUpdated": "2026-04-08T19:12:52.328Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "shortName": "wikimedia-foundation", "dateUpdated": "2026-04-08T19:12:52.328Z"}, "title": "ReportIncident DiscussionTools integration causes slow requests", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-770", "description": "CWE-770 Allocation of resources without limits or throttling", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-469", "descriptions": [{"lang": "en", "value": "CAPEC-469 HTTP DoS"}]}], "affected": [{"vendor": "Wikimedia Foundation", "product": "MediaWiki - ReportIncident Extension", "versions": [{"status": "affected", "version": "0", "lessThan": "1.43", "versionType": "custom"}, {"status": "affected", "version": "1.43"}, {"status": "affected", "version": "1.44"}, {"status": "affected", "version": "1.45"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Allocation of resources without limits or throttling vulnerability in Wikimedia Foundation MediaWiki - ReportIncident Extension allows HTTP DoS.\nThis issue was remediated only on the `master` branch.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Allocation of resources without limits or throttling vulnerability in Wikimedia Foundation MediaWiki - ReportIncident Extension allows HTTP DoS.<div><br><p>This issue was remediated only on the `master` branch.</p></div>"}]}], "references": [{"url": "https://phabricator.wikimedia.org/T414582"}, {"url": "https://gerrit.wikimedia.org/r/c/mediawiki/extensions/ReportIncident/+/1226884"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subAvailabilityImpact": "LOW", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L"}}], "credits": [{"lang": "en", "value": "Dreamy_Jazz", "type": "finder"}, {"lang": "en", "value": "STran", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.1"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-5762", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-07T20:34:37.836813Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-07T20:42:43.563Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-5762", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-07T20:34:37.836813Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-07T20:40:23.853Z"}}], "cna": {"title": "ReportIncident DiscussionTools integration causes slow requests", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Dreamy_Jazz"}, {"lang": "en", "type": "finder", "value": "STran"}], "impacts": [{"capecId": "CAPEC-469", "descriptions": [{"lang": "en", "value": "CAPEC-469 HTTP DoS"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Wikimedia Foundation", "product": "MediaWiki - ReportIncident Extension", "versions": [{"status": "affected", "version": "0", "lessThan": "1.43", "versionType": "custom"}, {"status": "affected", "version": "1.43"}, {"status": "affected", "version": "1.44"}, {"status": "affected", "version": "1.45"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://phabricator.wikimedia.org/T414582"}, {"url": "https://gerrit.wikimedia.org/r/c/mediawiki/extensions/ReportIncident/+/1226884"}], "x_generator": {"engine": "Vulnogram 1.0.1"}, "descriptions": [{"lang": "en", "value": "Allocation of resources without limits or throttling vulnerability in Wikimedia Foundation MediaWiki - ReportIncident Extension allows HTTP DoS.\nThis issue was remediated only on the `master` branch.", "supportingMedia": [{"type": "text/html", "value": "Allocation of resources without limits or throttling vulnerability in Wikimedia Foundation MediaWiki - ReportIncident Extension allows HTTP DoS.<div><br><p>This issue was remediated only on the `master` branch.</p></div>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770 Allocation of resources without limits or throttling"}]}], "providerMetadata": {"orgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "shortName": "wikimedia-foundation", "dateUpdated": "2026-04-08T19:12:52.328Z"}}}, "cveMetadata": {"cveId": "CVE-2026-5762", "state": "PUBLISHED", "dateUpdated": "2026-04-08T19:12:52.328Z", "dateReserved": "2026-04-07T18:21:15.769Z", "assignerOrgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "datePublished": "2026-04-07T18:42:35.336Z", "assignerShortName": "wikimedia-foundation"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "MediaWiki - ReportIncident Extension", "vendor": "Wikimedia Foundation", "versions": [{"lessThan": "1.43", "status": "affected", "version": "0", "versionType": "custom"}, {"status": "affected", "version": "1.43"}, {"status": "affected", "version": "1.44"}, {"status": "affected", "version": "1.45"}]}], "source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Allocation of resources without limits or throttling vulnerability in Wikimedia Foundation MediaWiki - ReportIncident Extension allows HTTP DoS.\nThis issue was remediated only on the `master` branch."}, {"lang": "es", "value": "Asignaci\u00f3n de recursos sin l\u00edmites o vulnerabilidad de limitaci\u00f3n en la extensi\u00f3n ReportIncident de MediaWiki de la Fundaci\u00f3n Wikimedia permite DoS HTTP. Este problema afecta a la extensi\u00f3n ReportIncident de MediaWiki: 1.43.7, 1.44.4, 1.45.2."}], "id": "CVE-2026-5762", "lastModified": "2026-07-21T19:10:00.107", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-5762", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-07T20:34:37.836813Z", "version": "2.0.3"}}]}, "published": "2026-04-07T19:16:48.347", "references": [{"source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "url": "https://gerrit.wikimedia.org/r/c/mediawiki/extensions/ReportIncident/+/1226884"}, {"source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "url": "https://phabricator.wikimedia.org/T414582"}], "sourceIdentifier": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.43.7"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.44.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.45.2"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "MediaWiki - ReportIncident Extension", "source": "cna", "vendor": "Wikimedia Foundation"}, "product": "mediawiki-reportincident_extension", "vendor": "wikimedia"}], "analysis": {"en": {"generated_at": "2026-04-08T21:07:50.438944+00:00", "value": {"mitigation_remediation": ["Update the ReportIncident Extension to the latest patched version from the master branch.", "If an immediate update is not possible, consider disabling or removing the faulty integration from the extension.", "Implement rate\u2011limiting or request throttling on the ReportIncident endpoints to mitigate DoS risk.", "Monitor web traffic for unusually high request rates and enforce IP blocking or temporary shutdowns if necessary."], "summary": {"action": "Immediate Patch", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "Vulnerable versions of the MediaWiki ReportIncident Extension distributed by the Wikimedia Foundation prior to the latest master branch patch are affected. The patch is only available on the master branch, meaning older stable releases remain at risk.", "description_and_impact": "The ReportIncident Extension contains a flaw that allows unbounded allocation of server resources, leading to a denial\u2011of\u2011service condition. This uncontrolled memory consumption is identified as CWE\u2011770.", "risk_and_exploitability": "The CVSS score of 5.3 rates the vulnerability as moderate while the EPSS score of less than 1\u202f% indicates a low likelihood of exploitation. Based on the description, the likely attack vector involves sending repeated HTTP requests to the ReportIncident endpoints, exhausting server resources. The vulnerability is not listed in the CISA KEV catalog and no public exploits are known, but the absence of throttling presents a clear path for a determined attacker to disrupt service."}}}}, "created": "2026-04-08T19:46:35.573823+00:00", "updated": "2026-04-09T08:28:42.107001+00:00", "vendors": ["wikimedia", "wikimedia$PRODUCT$mediawiki-reportincident_extension"]}