CVE-2026-100242: MediaWiki DataTransfer Extension DoS Flaw

CVE-2026-100242 Overview

CVE-2026-100242 affects the Wikimedia Foundation MediaWiki DataTransfer Extension. The flaw stems from a dependency on a vulnerable third-party component combined with uncontrolled resource consumption [CWE-400]. Attackers can trigger excessive memory or CPU allocation during data import operations handled by the extension. The issue impacts DataTransfer Extension versions from 1.46.0 before 1.47.0.

Critical Impact
Attackers can exhaust server resources by submitting crafted input to the DataTransfer Extension, degrading wiki availability for legitimate users.

Affected Products

Wikimedia Foundation MediaWiki DataTransfer Extension 1.46.0
Wikimedia Foundation MediaWiki DataTransfer Extension versions up to (but not including) 1.47.0
MediaWiki instances that enable the DataTransfer Extension for content import/export

Discovery Timeline

2026-09-29 - CVE-2026-100242 published to the National Vulnerability Database (NVD)
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-100242

Vulnerability Analysis

The DataTransfer Extension provides bulk import and export of structured wiki content. The vulnerability arises from two combined weaknesses: reliance on a vulnerable third-party parsing component and the absence of resource limits during processing. Crafted input can cause the extension to allocate excessive memory or consume disproportionate CPU cycles. Repeated requests amplify the effect and can render the MediaWiki instance unresponsive.

Root Cause

The root cause is classified as CWE-400 (Uncontrolled Resource Consumption). The DataTransfer Extension processes untrusted input without enforcing bounds on allocation size, iteration depth, or execution time. The bundled third-party dependency propagates its own parsing weakness into the extension's request path, so malformed payloads are accepted and expanded during import handling.

Attack Vector

An attacker submits specially crafted import payloads to endpoints exposed by the DataTransfer Extension. Depending on wiki configuration, the required privilege level ranges from an authenticated editor to any user permitted to invoke import functionality. No memory corruption or code execution is required; the impact is denial of service through resource exhaustion. Refer to the GitHub Security Advisory GHSA-xh5m-36r6-47m3 and Wikimedia Phabricator Task T433275 for coordination details.

Detection Methods for CVE-2026-100242

Indicators of Compromise

Sustained spikes in PHP worker memory allocation correlated with requests to DataTransfer import endpoints.
Repeated HTTP requests to Special:DataTransfer or related import URLs from a single source, followed by 5xx errors.
MediaWiki job queue backlog growth and out of memory fatal errors in PHP-FPM or Apache logs.

Detection Strategies

Baseline normal request duration and payload size for DataTransfer endpoints, then alert on statistical outliers.
Correlate web server access logs with system metrics to identify import requests that precede memory or CPU saturation.
Inspect uploaded import files for abnormally deep structures or oversized field counts before processing.

Monitoring Recommendations

Track PHP memory_get_peak_usage() values per request handling DataTransfer operations.
Monitor MediaWiki error logs for PHP Fatal error: Allowed memory size exhausted messages.
Alert on sudden increases in 502/503/504 responses from the MediaWiki application tier.

How to Mitigate CVE-2026-100242

Immediate Actions Required

Upgrade the MediaWiki DataTransfer Extension to version 1.47.0 or later.
Restrict access to import functionality to trusted editor groups until the upgrade is deployed.
Enforce PHP memory_limit and max_execution_time values that bound the impact of a single request.

Patch Information

The fix is tracked in the Wikimedia Gerrit Change Request Ibc4a9070c2425b690bc767a882e4c35046a39be7 and shipped in DataTransfer Extension 1.47.0. Administrators should update the extension through their standard MediaWiki extension management process and verify the reported version after deployment. Additional coordination details are available in Wikimedia Phabricator Task T433275.

Workarounds

Disable the DataTransfer Extension in LocalSettings.php until patching is complete.
Place a reverse proxy rule that limits request body size and rate for DataTransfer endpoints.
Restrict the import and datatransfer-import user rights to a small set of trusted administrators.

bash

# Configuration example: temporarily disable DataTransfer and cap resources in LocalSettings.php
# wfLoadExtension( 'DataTransfer' );   // comment out until upgraded to 1.47.0
ini_set( 'memory_limit', '256M' );
ini_set( 'max_execution_time', '30' );
$wgGroupPermissions['user']['datatransfer-import'] = false;
$wgGroupPermissions['sysop']['datatransfer-import'] = true;