CVE-2021-41118

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The DynamicPageList3 extension is a reporting tool for MediaWiki, listing category members and intersections with various formats and details. In affected versions unsanitised input of regular expression date within the parameters of the DPL parser function, allowed for the possibility of ReDoS (Regex Denial of Service). This has been resolved in version 3.3.6. If you are unable to update you may also set `$wgDplSettings['functionalRichness'] = 0;` or disable DynamicPageList3 to mitigate.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

No affected versions have been published.

Timeline

Published
Oct 4, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-411197.5Wire-server is the system server for the wire back-end services. Releases prior to v2022-03-01 are subject to a denial of service attack viaCVE-2021-41128.8A flaw was found in ansible-tower where the default installation is vulnerable to job isolation escape. This flaw allows an attacker to elevCVE-2021-411207.5sylius/paypal-plugin is a paypal plugin for the Sylius development platform. In affected versions the URL to the payment page done after cheCVE-2021-411218.8Vyper is a Pythonic Smart Contract Language for the EVM. In affected versions when performing a function call inside a literal struct, thereCVE-2021-411224.3Vyper is a Pythonic Smart Contract Language for the EVM. In affected versions external functions did not properly validate the bounds of decCVE-2021-411235.3Survey Solutions is a survey management and data collection system. In affected versions the Headquarters application publishes /metrics endCVE-2021-411247.5Scrapy-splash is a library which provides Scrapy and JavaScript integration. In affected versions users who use [`HttpAuthMiddleware`](http:CVE-2021-411256.5Scrapy is a high-level web crawling and scraping framework for Python. If you use `HttpAuthMiddleware` (i.e. the `http_user` and `http_pass`CVE-2021-411267.2October is a Content Management System (CMS) and web platform built on the the Laravel PHP Framework. In affected versions administrator accCVE-2021-411277.1Rasa is an open source machine learning framework to automate text-and voice-based conversations. In affected versions a vulnerability existCVE-2021-411288.8Hygeia is an application for collecting and processing personal and case data in connection with communicable diseases. In affected versionsCVE-2021-411298.1Pterodactyl is an open-source game server management panel built with PHP 7, React, and Go. A malicious user can modify the contents of a `c
CVE-2021-41118: High severity, CVSS 7.5 | Vulnix