CVE-2026-39934
MediumCVSS 6.9Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
The GrowthExperiments extension in MediaWiki contains an infinite loop vulnerability that allows leveraging Time-of-Check Time-of-Use (TOCTOU) race conditions. This issue was fixed only on the `master` branch.
Risk Assessment
An attacker can exploit this race condition to cause unpredictable system behavior or data leakage.
Recommendation
Immediately update MediaWiki to the latest version from the `master` branch or apply temporary mitigations until an official patch is released.
Original NVD description (English source)
Loop with unreachable exit condition ('infinite loop') vulnerability in The Wikimedia Foundation Mediawiki - GrowthExperiments Extension allows Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions. This issue was remediated only on the `master` branch.