CVE-2025-11175: MediaWiki DiscussionTools ReDoS Vulnerability

CVE-2025-11175 Overview

CVE-2025-11175 is an Expression Language Injection vulnerability affecting the MediaWiki DiscussionTools Extension developed by The Wikimedia Foundation. This vulnerability allows attackers to exploit improper neutralization of special elements in expression language statements to trigger Regular Expression Exponential Blowup (ReDoS), potentially causing significant denial of service conditions on affected MediaWiki installations.

The vulnerability stems from insufficient input validation in the DiscussionTools Extension, which can be exploited remotely without authentication. Successful exploitation enables attackers to craft malicious input that causes exponential backtracking in regular expression processing, leading to CPU exhaustion and service degradation.

Critical Impact

This network-accessible vulnerability allows unauthenticated attackers to trigger ReDoS attacks against MediaWiki installations running the vulnerable DiscussionTools Extension, potentially causing complete service unavailability.

Affected Products

• MediaWiki DiscussionTools Extension version 1.44
• MediaWiki DiscussionTools Extension version 1.43

Discovery Timeline

• 2026-01-30 - CVE-2025-11175 published to NVD
• 2026-02-04 - Last updated in NVD database

Technical Details for CVE-2025-11175

Vulnerability Analysis

The vulnerability is classified under CWE-917 (Improper Neutralization of Special Elements used in an Expression Language Statement). This weakness category describes scenarios where an application constructs expression language statements from user-controlled input without properly neutralizing special syntax elements.

In the case of CVE-2025-11175, the vulnerability manifests in the DiscussionTools Extension's handling of user input, which is processed through regular expression patterns susceptible to catastrophic backtracking. When specially crafted input is provided, the regex engine enters an exponential time complexity state, consuming excessive CPU resources.

The attack is network-accessible and requires no authentication or user interaction, making it particularly dangerous for publicly accessible MediaWiki installations. Successful exploitation can lead to high confidentiality impact and limited integrity compromise, while also affecting connected systems through secondary impacts.

Root Cause

The root cause lies in the improper handling of expression language elements within the DiscussionTools Extension. The extension fails to adequately sanitize or validate input that is subsequently processed by vulnerable regular expression patterns. These patterns contain constructs that enable exponential backtracking when fed specific input sequences, a classic ReDoS vulnerability pattern.

The vulnerable code paths process user-supplied content through regex operations without implementing safeguards such as input length limits, regex timeout mechanisms, or pattern optimization to prevent catastrophic backtracking scenarios.

Attack Vector

The attack vector is network-based, allowing remote exploitation. An attacker can craft malicious input containing specific character sequences designed to trigger exponential backtracking in the vulnerable regular expression patterns. The attack methodology follows these general steps:

1. The attacker identifies a MediaWiki installation running the vulnerable DiscussionTools Extension versions (1.43 or 1.44)
2. Malicious input is constructed using repeating patterns that maximize regex backtracking iterations
3. The crafted payload is submitted through discussion-related functionality in MediaWiki
4. The regex engine processes the input, entering an exponential time complexity state
5. Server resources are exhausted, leading to denial of service conditions

Technical details regarding the specific vulnerable patterns can be found in the Wikimedia Phabricator Task T364910 and the associated Gerrit code review.

Detection Methods for CVE-2025-11175

Indicators of Compromise

• Abnormally high CPU utilization on MediaWiki application servers, particularly during discussion-related operations
• Slow response times or timeouts on pages using DiscussionTools functionality
• Unusual patterns in web server logs showing repeated requests to discussion endpoints with large or malformed payloads
• Process monitoring showing PHP or application workers consuming 100% CPU for extended periods

Detection Strategies

• Monitor server CPU utilization patterns for sustained spikes correlating with DiscussionTools usage
• Implement web application firewall rules to detect and block requests containing known ReDoS trigger patterns
• Configure application-level logging to capture input size and processing time for discussion-related functions
• Deploy intrusion detection signatures to identify exploitation attempts targeting MediaWiki discussion functionality

Monitoring Recommendations

• Set up alerting thresholds for CPU utilization on MediaWiki servers exceeding normal baseline by significant margins
• Monitor application response times for discussion-related endpoints with automated alerting for degradation
• Review web server access logs for anomalous request patterns targeting DiscussionTools functionality
• Implement rate limiting on discussion-related endpoints to mitigate the impact of potential exploitation attempts

How to Mitigate CVE-2025-11175

Immediate Actions Required

• Identify all MediaWiki installations running DiscussionTools Extension versions 1.43 or 1.44
• Review the official patches available through the Wikimedia Gerrit Patch Proposal
• Apply the security patches to affected installations as soon as possible
• Consider temporarily disabling the DiscussionTools Extension on critical systems until patches can be applied
• Implement network-level rate limiting on discussion-related endpoints as an interim measure

Patch Information

The Wikimedia Foundation has addressed this vulnerability through code changes available in their Gerrit repository. Administrators should review and apply the patches referenced in the following resources:

• Gerrit Patch Proposal I126203ab1d3ec8c1719cbb5460a887e4d0c2cc6d
• Gerrit Code Review I563219f3298a8740e158d130492bf3d2897784d7

Additional context and discussion about the vulnerability can be found in the Wikimedia Phabricator tasks T364910 and T396248.

Workarounds

• Disable the DiscussionTools Extension temporarily by removing it from the LocalSettings.php configuration file
• Implement web application firewall rules to limit input length on discussion-related endpoints
• Configure PHP timeouts to prevent individual requests from consuming excessive processing time
• Deploy rate limiting at the reverse proxy or load balancer level to restrict the impact of potential exploitation

# Example: Disable DiscussionTools in MediaWiki LocalSettings.php
# Comment out or remove the following line:
# wfLoadExtension( 'DiscussionTools' );

# Example: Apache rate limiting configuration
<Location "/wiki/Special:">
    SetEnvIf Request_URI "Discussion" rate_limit
    # Implement mod_ratelimit or similar
</Location>