CVE-2026-0668
📋 TL;DR
This CVE describes an Inefficient Regular Expression Complexity vulnerability (Regular Expression Exponential Blowup) in the MediaWiki VisualData Extension. It allows attackers to cause denial of service by crafting malicious input that triggers catastrophic backtracking in regular expressions. This affects MediaWiki installations using VisualData Extension version 1.45.
💻 Affected Systems
- MediaWiki VisualData Extension
📦 What is this software?
Visualdata by Wikisphere
⚠️ Risk & Real-World Impact
Worst Case
Complete service unavailability due to resource exhaustion (CPU/memory) leading to denial of service for all users.
Likely Case
Degraded performance or temporary service disruption affecting users accessing pages with the vulnerable VisualData Extension.
If Mitigated
Minimal impact with proper input validation and resource limits in place.
🎯 Exploit Status
Attack requires sending specially crafted input to endpoints using the vulnerable VisualData Extension.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check provided gerrit links for specific commit fixes
Vendor Advisory: https://phabricator.wikimedia.org/T387008
Restart Required: No
Instructions:
1. Review provided gerrit links for specific fixes. 2. Apply patches to VisualData Extension code. 3. Update to patched version of VisualData Extension.
🔧 Temporary Workarounds
Disable VisualData Extension
allTemporarily disable the vulnerable VisualData Extension until patched.
Edit LocalSettings.php and remove or comment VisualData Extension loading
Implement Input Validation
allAdd input validation and length limits to endpoints using VisualData Extension.
🧯 If You Can't Patch
- Implement WAF rules to block suspicious regex patterns or large inputs
- Monitor server resources and implement rate limiting on affected endpoints
🔍 How to Verify
Check if Vulnerable:
Check if VisualData Extension version 1.45 is installed and enabled in MediaWiki.Check Version:
Check MediaWiki extensions directory or extension.json file for VisualData Extension versionVerify Fix Applied:
Verify VisualData Extension has been updated with patches from provided gerrit links.📡 Detection & Monitoring
Log Indicators:
- High CPU/memory usage spikes
- Slow response times from VisualData endpoints
- Error logs showing regex timeouts
Network Indicators:
- Unusually large POST requests to VisualData endpoints
- Repeated requests to same VisualData endpoints
SIEM Query:
source="apache" OR source="nginx" AND (uri="*VisualData*" OR uri="*visualdata*") AND (response_time > 5000 OR status=500)🔗 References
- https://gerrit.wikimedia.org/r/q/I4ff2737c9f0ba805267d1fc8296e7cff61241ee3
- https://gerrit.wikimedia.org/r/q/I893a9fca694a2613e29e149dea2d76d7f06063e5
- https://gerrit.wikimedia.org/r/q/Ie08d9a8ceb2c9a22a635cfc27964353f14072dbf
- https://gerrit.wikimedia.org/r/q/Ifbf9c2ade621226e14fe852f3217293772bf8bb8
- https://phabricator.wikimedia.org/T387008
