CVE-2026-0668: MediaWiki VisualData Extension DoS Flaw

CVE-2026-0668 Overview

CVE-2026-0668 is an Inefficient Regular Expression Complexity vulnerability affecting the Wikimedia Foundation MediaWiki VisualData Extension. This vulnerability allows attackers to trigger Regular Expression Exponential Blowup (ReDoS), potentially causing denial of service conditions on affected MediaWiki installations.

The vulnerability exists due to poorly constructed regular expressions within the VisualData extension that exhibit catastrophic backtracking behavior when processing specially crafted input. An unauthenticated remote attacker can exploit this flaw by sending malicious requests that cause the regular expression engine to enter an exponential processing state, consuming excessive CPU resources.

Critical Impact

Remote attackers can cause denial of service by triggering exponential regex processing, degrading MediaWiki server performance and availability.

Affected Products

• MediaWiki VisualData Extension version 1.45
• Wikimedia Foundation MediaWiki installations with VisualData Extension enabled
• Self-hosted MediaWiki deployments using the vulnerable extension version

Discovery Timeline

• 2026-01-07 - CVE-2026-0668 published to NVD
• 2026-01-08 - Last updated in NVD database

Technical Details for CVE-2026-0668

Vulnerability Analysis

This vulnerability falls under CWE-1333 (Inefficient Regular Expression Complexity), a class of algorithmic complexity attacks targeting regex engines. The VisualData extension contains regular expression patterns susceptible to exponential time complexity when matched against adversarial input strings.

Regular Expression Denial of Service (ReDoS) attacks exploit the backtracking behavior of Non-deterministic Finite Automaton (NFA) based regex engines commonly used in PHP (which powers MediaWiki). When a regex contains nested quantifiers or overlapping alternations, certain input strings can cause the matching algorithm to explore an exponentially growing number of paths before determining a match failure.

The network-accessible attack vector with no authentication requirements means any remote user can send crafted requests to a vulnerable MediaWiki instance. While the impact is limited to availability degradation rather than data compromise or code execution, sustained attacks could render wiki services unavailable.

Root Cause

The root cause is the presence of inefficient regular expression patterns within the VisualData extension codebase. These patterns likely contain problematic constructs such as:

• Nested quantifiers (e.g., (a+)+)
• Overlapping alternations with repetition
• Greedy quantifiers followed by patterns that can match the same characters

The Wikimedia Foundation has addressed this through multiple code changes, as evidenced by the Gerrit commits referenced in the security disclosure. These patches likely rewrite the problematic regular expressions to use more efficient patterns or implement input validation to limit the attack surface.

Attack Vector

The attack is conducted remotely over the network without requiring authentication or user interaction. An attacker can craft HTTP requests containing input strings designed to trigger catastrophic backtracking in the vulnerable regex patterns.

The attack methodology involves:

1. Identifying input fields processed by the VisualData extension
2. Constructing input strings that maximize backtracking paths
3. Sending multiple concurrent requests to amplify resource exhaustion
4. Sustaining the attack to degrade or deny service to legitimate users

For technical details on the specific regex patterns and fixes, see the Wikimedia Phabricator Task T387008 and associated Gerrit code reviews.

Detection Methods for CVE-2026-0668

Indicators of Compromise

• Abnormally high CPU utilization on MediaWiki web server processes
• Extended PHP process execution times exceeding normal request durations
• Request timeouts or 503 errors from the MediaWiki application
• Web server logs showing repeated requests with unusually long response times to VisualData extension endpoints

Detection Strategies

• Monitor web application firewall (WAF) logs for requests with abnormally large or repetitive input patterns targeting VisualData endpoints
• Implement request timeout monitoring to detect long-running regex operations
• Deploy anomaly detection for CPU utilization spikes correlated with MediaWiki request patterns
• Review PHP slow query logs for extended execution in VisualData extension code paths

Monitoring Recommendations

• Configure alerting for MediaWiki PHP processes exceeding normal execution time thresholds
• Implement rate limiting on VisualData extension input endpoints to reduce attack amplification
• Monitor server resource utilization with correlation to incoming request patterns
• Enable detailed logging for the VisualData extension to aid in forensic analysis

How to Mitigate CVE-2026-0668

Immediate Actions Required

• Update the MediaWiki VisualData Extension to a patched version that addresses the inefficient regex patterns
• Review the Wikimedia Gerrit changes and apply relevant patches to self-hosted installations
• Implement request timeout limits at the web server level to terminate long-running requests
• Consider temporarily disabling the VisualData extension if patching is not immediately possible

Patch Information

Wikimedia Foundation has released patches addressing this vulnerability through their Gerrit code review system. The following changes should be reviewed and applied:

• Wikimedia Gerrit Change I4ff2737
• Wikimedia Gerrit Change I893a9f
• Wikimedia Gerrit Change Ie08d9a
• Wikimedia Gerrit Change Ifbf9c2

For complete technical details and discussion, refer to Wikimedia Phabricator Task T387008.

Workarounds

• Implement web server request timeouts to automatically terminate requests exceeding reasonable processing times
• Deploy a Web Application Firewall (WAF) with rules to detect and block requests containing ReDoS attack patterns
• Enable PHP execution time limits via max_execution_time configuration to prevent runaway processes
• Apply input length restrictions at the application or reverse proxy level to limit attack payload size

# PHP configuration to limit execution time
# Add to php.ini or .htaccess
max_execution_time = 30
max_input_time = 60
memory_limit = 128M

# Apache mod_reqtimeout configuration
RequestReadTimeout header=20-40,MinRate=500 body=20-40,MinRate=500