CVE-2025-61766

MediumCVSS 6.5

Published: 06/10/2025(UTC)Updated: 09/10/2026(UTC)Translated: 09/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.38%

30th percentile - higher than 30% of all known CVEs

Summary

Bucket is a MediaWiki extension to store and retrieve structured data on articles. Prior to version 1.0.0, infinite recursion can occur if a user queries a bucket using the `!=` comparator. This can result in PHP's call stack limit being exceeded and/or increased memory consumption, potentially leading to denial of service. Version 1.0.0 contains a patch.

Risk Assessment

The vulnerability can be exploited to perform a DoS attack on the MediaWiki server, potentially disrupting service availability for users.

Recommendation

It is recommended to update the Bucket extension to version 1.0.0 or later, which includes a fix.

Other vulnerabilities in Bucket

CVE-2026-30917High
The Bucket extension for MediaWiki before version 2.1.1 contains a stored XSS vulnerability. An attacker can inject malicious script into any Bucket table field of PAGE type, which executes when a user views the corresponding Bucket namespace page.

Original NVD description (English source)

Bucket is a MediaWiki extension to store and retrieve structured data on articles. Prior to version 1.0.0, infinite recursion can occur if a user queries a bucket using the `!=` comparator. This will result in PHP's call stack limit exceeding, and/or increased memory consumption, potentially leading to a denial of service. Version 1.0.0 contains a patch for the issue.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS