CVE-2025-11175: MediaWiki DiscussionTools ReDoS Vulnerability

CVE-2025-11175 Overview

CVE-2025-11175 is an Expression Language Injection vulnerability affecting the MediaWiki DiscussionTools Extension developed by The Wikimedia Foundation. This vulnerability allows attackers to exploit improper neutralization of special elements in expression language statements to trigger Regular Expression Exponential Blowup (ReDoS), potentially causing significant denial of service conditions on affected MediaWiki installations.

The vulnerability stems from insufficient input validation in the DiscussionTools Extension, which can be exploited remotely without authentication. Successful exploitation enables attackers to craft malicious input that causes exponential backtracking in regular expression processing, leading to CPU exhaustion and service degradation.

Critical Impact
This network-accessible vulnerability allows unauthenticated attackers to trigger ReDoS attacks against MediaWiki installations running the vulnerable DiscussionTools Extension, potentially causing complete service unavailability.

Affected Products

MediaWiki DiscussionTools Extension version 1.44
MediaWiki DiscussionTools Extension version 1.43

Discovery Timeline

2026-01-30 - CVE-2025-11175 published to NVD
2026-02-04 - Last updated in NVD database

Technical Details for CVE-2025-11175

Vulnerability Analysis

The vulnerability is classified under CWE-917 (Improper Neutralization of Special Elements used in an Expression Language Statement). This weakness category describes scenarios where an application constructs expression language statements from user-controlled input without properly neutralizing special syntax elements.

In the case of CVE-2025-11175, the vulnerability manifests in the DiscussionTools Extension's handling of user input, which is processed through regular expression patterns susceptible to catastrophic backtracking. When specially crafted input is provided, the regex engine enters an exponential time complexity state, consuming excessive CPU resources.

The attack is network-accessible and requires no authentication or user interaction, making it particularly dangerous for publicly accessible MediaWiki installations. Successful exploitation can lead to high confidentiality impact and limited integrity compromise, while also affecting connected systems through secondary impacts.

Root Cause

The root cause lies in the improper handling of expression language elements within the DiscussionTools Extension. The extension fails to adequately sanitize or validate input that is subsequently processed by vulnerable regular expression patterns. These patterns contain constructs that enable exponential backtracking when fed specific input sequences, a classic ReDoS vulnerability pattern.

The vulnerable code paths process user-supplied content through regex operations without implementing safeguards such as input length limits, regex timeout mechanisms, or pattern optimization to prevent catastrophic backtracking scenarios.

Attack Vector

The attack vector is network-based, allowing remote exploitation. An attacker can craft malicious input containing specific character sequences designed to trigger exponential backtracking in the vulnerable regular expression patterns. The attack methodology follows these general steps:

The attacker identifies a MediaWiki installation running the vulnerable DiscussionTools Extension versions (1.43 or 1.44)
Malicious input is constructed using repeating patterns that maximize regex backtracking iterations
The crafted payload is submitted through discussion-related functionality in MediaWiki
The regex engine processes the input, entering an exponential time complexity state
Server resources are exhausted, leading to denial of service conditions

Technical details regarding the specific vulnerable patterns can be found in the Wikimedia Phabricator Task T364910 and the associated Gerrit code review.

Detection Methods for CVE-2025-11175

Indicators of Compromise

Abnormally high CPU utilization on MediaWiki application servers, particularly during discussion-related operations
Slow response times or timeouts on pages using DiscussionTools functionality
Unusual patterns in web server logs showing repeated requests to discussion endpoints with large or malformed payloads
Process monitoring showing PHP or application workers consuming 100% CPU for extended periods

Detection Strategies

Monitor server CPU utilization patterns for sustained spikes correlating with DiscussionTools usage
Implement web application firewall rules to detect and block requests containing known ReDoS trigger patterns
Configure application-level logging to capture input size and processing time for discussion-related functions
Deploy intrusion detection signatures to identify exploitation attempts targeting MediaWiki discussion functionality

Monitoring Recommendations

Set up alerting thresholds for CPU utilization on MediaWiki servers exceeding normal baseline by significant margins
Monitor application response times for discussion-related endpoints with automated alerting for degradation
Review web server access logs for anomalous request patterns targeting DiscussionTools functionality
Implement rate limiting on discussion-related endpoints to mitigate the impact of potential exploitation attempts

How to Mitigate CVE-2025-11175

Immediate Actions Required

Identify all MediaWiki installations running DiscussionTools Extension versions 1.43 or 1.44
Review the official patches available through the Wikimedia Gerrit Patch Proposal
Apply the security patches to affected installations as soon as possible
Consider temporarily disabling the DiscussionTools Extension on critical systems until patches can be applied
Implement network-level rate limiting on discussion-related endpoints as an interim measure

Patch Information

The Wikimedia Foundation has addressed this vulnerability through code changes available in their Gerrit repository. Administrators should review and apply the patches referenced in the following resources:

Additional context and discussion about the vulnerability can be found in the Wikimedia Phabricator tasks T364910 and T396248.

Workarounds

Disable the DiscussionTools Extension temporarily by removing it from the LocalSettings.php configuration file
Implement web application firewall rules to limit input length on discussion-related endpoints
Configure PHP timeouts to prevent individual requests from consuming excessive processing time
Deploy rate limiting at the reverse proxy or load balancer level to restrict the impact of potential exploitation

bash

# Example: Disable DiscussionTools in MediaWiki LocalSettings.php
# Comment out or remove the following line:
# wfLoadExtension( 'DiscussionTools' );

# Example: Apache rate limiting configuration
<Location "/wiki/Special:">
    SetEnvIf Request_URI "Discussion" rate_limit
    # Implement mod_ratelimit or similar
</Location>