CVE-2026-100242CWE-400denial-of-service

CVE-2026-100242

High · published September 29, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
26.1
In the wild
Unconfirmed
What it is

Dependency on Vulnerable Third-Party Component and Uncontrolled Resource Consumption vulnerability in Wikimedia Foundation Mediawiki - DataTransfer Extension allows Excessive Allocation.

This issue affects Mediawiki - DataTransfer Extension: from 1.46.0 before 1.47.0.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00339 · 26.1th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2026-09-29T21:17Z
References (4)
https://gerrit.wikimedia.org/r/q/Ibc4a9070c2425b690bc767a882e4c35046a39be7 · c4f26cc8-17ff-4c99-b5e2-38fc1793eacchttps://github.com/advisories/GHSA-xh5m-36r6-47m3 · c4f26cc8-17ff-4c99-b5e2-38fc1793eacchttps://phabricator.wikimedia.org/T433275 · c4f26cc8-17ff-4c99-b5e2-38fc1793eacchttps://github.com/advisories/GHSA-xh5m-36r6-47m3 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 01 OCT 03:44Z
    EPSS moved — → 0%
    epss
  • 29 SEP 16:40Z
    DataTransfer depends on phpspreadsheet version vulnerable to CVE-2026-59933 (XLS/OLE memory exhaustion)
    cvelistv5