CVE-2026-39934: MediaWiki GrowthExperiments Race Condition

CVE-2026-39934 Overview

CVE-2026-39934 is an infinite loop vulnerability combined with a Time-of-Check Time-of-Use (TOCTOU) race condition affecting The Wikimedia Foundation's MediaWiki GrowthExperiments Extension. The vulnerability stems from a loop with an unreachable exit condition (CWE-835), which can be leveraged through race condition exploitation to cause denial of service or potentially manipulate application state.

This issue has been remediated only on the master branch, meaning production deployments may still be vulnerable if running older versions of the extension.

Critical Impact

Attackers can exploit the infinite loop condition through network-accessible vectors without authentication, potentially causing resource exhaustion and service disruption on affected MediaWiki installations.

Affected Products

• MediaWiki - GrowthExperiments Extension (versions prior to master branch fix)
• MediaWiki installations utilizing the GrowthExperiments Extension
• Wikimedia Foundation hosted wikis running vulnerable extension versions

Discovery Timeline

• 2026-04-07 - CVE-2026-39934 published to NVD
• 2026-04-08 - Last updated in NVD database

Technical Details for CVE-2026-39934

Vulnerability Analysis

The vulnerability exists within the GrowthExperiments Extension for MediaWiki, a component designed to enhance the editing experience for new wiki contributors. The flaw combines two distinct vulnerability classes: an infinite loop condition (CWE-835) and a TOCTOU race condition.

The infinite loop occurs when the application enters a loop construct that lacks a reachable exit condition under certain circumstances. When combined with the TOCTOU race condition, an attacker can manipulate the state between the time a condition is checked and when the corresponding action is performed, forcing the loop into an unrecoverable state.

This vulnerability is network-accessible and requires no user interaction or prior authentication, making it particularly concerning for public-facing MediaWiki installations.

Root Cause

The root cause is a loop construct within the GrowthExperiments Extension that contains an exit condition dependent on state that can be manipulated through concurrent requests. The TOCTOU window allows an attacker to change the state after the exit condition is evaluated but before the loop iteration completes, effectively making the exit condition unreachable.

The fix applied to the master branch addresses this by implementing proper synchronization mechanisms and ensuring the loop exit condition cannot be invalidated by external state changes during execution.

Attack Vector

The attack leverages network access to the MediaWiki installation. An attacker can craft requests that trigger the vulnerable code path while simultaneously sending additional requests to manipulate the shared state. This creates the race condition necessary to trap the application in an infinite loop.

The attack does not require authentication or any special privileges, making it accessible to anonymous remote attackers. The exploitation technique involves:

1. Identifying endpoints that trigger the vulnerable loop in the GrowthExperiments Extension
2. Timing concurrent requests to exploit the TOCTOU window
3. Manipulating state between the check and use phases to invalidate the loop exit condition

For detailed technical information about the vulnerability and the fix, refer to the Wikimedia Code Review and the Wikimedia Task Discussion.

Detection Methods for CVE-2026-39934

Indicators of Compromise

• Unusual CPU utilization spikes on MediaWiki web servers running GrowthExperiments
• PHP process threads consuming excessive CPU time without completing requests
• Timeout errors in web server logs associated with GrowthExperiments Extension endpoints
• Increased memory consumption correlating with stuck worker processes

Detection Strategies

• Monitor for anomalous request patterns targeting GrowthExperiments Extension endpoints
• Implement request rate limiting and timeout detection for extension-related API calls
• Deploy application performance monitoring to detect runaway processes
• Review web server access logs for rapid successive requests from single sources targeting the same endpoints

Monitoring Recommendations

• Configure alerting for PHP-FPM or mod_php worker processes exceeding expected execution time
• Establish baseline metrics for GrowthExperiments Extension response times and alert on significant deviations
• Enable detailed logging for the GrowthExperiments Extension to capture request parameters
• Monitor system resource utilization (CPU, memory) at the process level for MediaWiki workers

How to Mitigate CVE-2026-39934

Immediate Actions Required

• Update the GrowthExperiments Extension to the latest version from the master branch
• Review MediaWiki installation for any signs of exploitation or resource exhaustion
• Implement request rate limiting on MediaWiki API endpoints
• Consider temporarily disabling the GrowthExperiments Extension if immediate patching is not feasible

Patch Information

The vulnerability has been remediated in the master branch of the GrowthExperiments Extension. Administrators should pull the latest changes from the official Wikimedia repository. The specific fix can be reviewed at the Wikimedia Gerrit code review.

For additional context and discussion regarding this security issue, consult the Phabricator task.

Workarounds

• Implement web application firewall (WAF) rules to limit request rates to GrowthExperiments endpoints
• Configure PHP execution timeouts to automatically terminate runaway processes
• Restrict access to the GrowthExperiments Extension to authenticated users if feasible
• Deploy reverse proxy request queuing to prevent concurrent request flooding

# Example Apache configuration to limit request rates
# Add to MediaWiki virtual host configuration
<Location "/w/api.php">
    SetEnvIf Request_URI "growthexperiments" rate_limit
    <If "env('rate_limit')">
        # Limit requests per IP
        SetEnvIfNoCase Request_Method ".*" ratelimit
    </If>
</Location>

# PHP timeout configuration in php.ini
max_execution_time = 30
max_input_time = 60