CVE-2021-41118 json
ReDoS in DynamicPageList3
published 2021-10-04 5 y ago modified 2026-06-17 4 mo ago also EUVD-2021-28249
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.2%
- EPSS 1.2% chance of exploitation in 30 days, percentile 67%
- public exploits
- 0
- none known
Summary
The DynamicPageList3 extension is a reporting tool for MediaWiki, listing category members and intersections with various formats and details. In affected versions unsanitised input of regular expression date within the parameters of the DPL parser function, allowed for the possibility of ReDoS (Regex Denial of Service). This has been resolved in version 3.3.6. If you are unable to update you may also set `$wgDplSettings['functionalRichness'] = 0;` or disable DynamicPageList3 to mitigate.
Patch / fix
- dynamicpagelist3_project dynamicpagelist3 3.3.6
Exploit prediction
1.16% chance of exploitation in the next 30 days, higher than 67% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:N/I:N/A:P |
Affected products
- Universal-Omega DynamicPageList3
Classification
- Weakness
-
- CWE-400 Uncontrolled Resource Consumption
References
-
github.com
/Universal-Omega/DynamicPageList3/commit/2c04dafb37a14d9ccfe070f53e7f11bbca0156e7
patch, third-party-advisory
-
github.com
/Universal-Omega/DynamicPageList3/security/advisories/GHSA-8f24-q75c-jhf4
mitigation, third-party-advisory
-
github.com
/Universal-Omega/DynamicPageList3/releases/tag/3.3.6
release-notes, third-party-advisory
Sources
- CVE List CVE-2021-41118
- NVD CVE-2021-41118
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.