CVE-2026-39934
MediumCVSS 6.9Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
The GrowthExperiments extension in MediaWiki contains an infinite loop vulnerability that allows leveraging Time-of-Check Time-of-Use (TOCTOU) race conditions. This issue was fixed only on the `master` branch.
Risk Assessment
An attacker can exploit this race condition to cause unpredictable system behavior or data leakage.
Recommendation
Immediately update MediaWiki to the latest version from the `master` branch or apply temporary mitigations until an official patch is released.
Other vulnerabilities in MediaWiki
See all- CVE-2026-34092High
A vulnerability in MediaWiki related to the exposure of sensitive information to unauthorized actors. It affects program files includes/Skin/Skin.Php.
- CVE-2026-34091High
CVE-2026-34091 describes an exposure of sensitive information to unauthorized actors in MediaWiki. This affects versions before 1.43.7, 1.44.4, and 1.45.2.
- CVE-2026-34088High
CVE-2026-34088 involves the exposure of sensitive information to unauthorized actors in MediaWiki. This affects versions before 1.43.7, 1.44.4, and 1.45.2.
- CVE-2017-8815High
The language converter in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows attribute injection attacks via glossary rules.
- CVE-2017-8814High
The language converter in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows attackers to replace text inside tags via a rule definition followed by 'a lot of junk.'
- CVE-2017-8810High
MediaWiki versions before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2, when a private wiki is configured, provide different error messages for failed login attempts depending on whether the username exists. This allows remote attackers to enumerate account names and conduct brute-force attacks.
- CVE-2012-4380High
MediaWiki versions before 1.18.5 and 1.19.x before 1.19.2 allow remote attackers to bypass GlobalBlocking extension IP address blocking and create an account via unspecified vectors.
- CVE-2016-6337High
MediaWiki 1.27.x before 1.27.1 might allow remote attackers to bypass intended session access restrictions by leveraging a call to the UserGetRights function after Session::getAllowedUserRights.
- CVE-2016-6335High
MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 does not generate head items in the context of a given title, allowing remote attackers to obtain sensitive information via a parse action to api.php.
- CVE-2016-6332High
MediaWiki versions before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1, when $wgBlockDisablesLogin is true, may allow remote attackers to obtain sensitive information by failing to terminate sessions when a user account is blocked.
Original NVD description (English source)
Loop with unreachable exit condition ('infinite loop') vulnerability in The Wikimedia Foundation Mediawiki - GrowthExperiments Extension allows Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions. This issue was remediated only on the `master` branch.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS