CVE-2026-5762: ReportIncident DiscussionTools integration causes slow requests with occasional timeouts on large talk pages
Closed, ResolvedPublicSecurity
Actions

Assigned To

Authored By

	Dreamy_Jazz
	Jan 14 2026, 2:08 PM

Project Tags

Referenced Files

	F71525660: image.png
	Jan 14 2026, 2:08 PM

	F71525663: image.png
	Jan 14 2026, 2:08 PM

Subscribers

View All 14 Subscribers

Description

Summary

The queries to validate the Incident-Reporting-System MediaWiki-extensions-CommunityConfiguration configuration is slow on pages with many DiscussionTools reply links, such as large user talk page archives

Background

The excimer profile is shown below (both left heavy and time order):

The issue is that the validation of the config seems to involve some kind of DB query that ends up being uncached and repeated for each DiscussionTools reply link

Steps to replicate the issue (include links if applicable):

Open https://pt.wikipedia.org/wiki/Usu%C3%A1rio_Discuss%C3%A3o:K%C3%A1ssio_Santiago/arquivo01

What happens?:
The request takes a long time and may cause a RequestTimeoutException

What should have happened instead?:
The timeout should not happen and the page should load in a reasonable time

Details

Risk Rating: Low
Author Affiliation: WMF Product

Related Changes in Gerrit:

Subject	Author	Repo	Branch	Lines +/-
Only validate IRS configs on writes; skip validations for reads	STran	mediawiki/extensions/ReportIncident	master	+10 -28
Only validate IRS configs on writes; skip validations for reads	Dreamy Jazz	mediawiki/extensions/ReportIncident	wmf/1.46.0-wmf.10	+10 -28
Only validate IRS configs on writes; skip validations for reads	Dreamy Jazz	mediawiki/extensions/ReportIncident	wmf/1.46.0-wmf.11	+10 -28

Customize query in gerrit

Related Objects

Mentioned In: T411394: Write and send supplementary release announcement for extensions and skins with security patches (1.43.7/1.44.4/1.45.2)
rEREIe9537cd03227: Only validate IRS configs on writes; skip validations for reads
rEREI5c4e7dc67b08: Only validate IRS configs on writes; skip validations for reads
rEREIfcc9ec2e6068: Only validate IRS configs on writes; skip validations for reads
Mentioned Here: rEREI7d6d26fcf6af: Minor fixes to v2 non-emergency workflow

Event Timeline

Dreamy_Jazz created this task.Jan 14 2026, 2:08 PM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptJan 14 2026, 2:08 PM

Dreamy_Jazz updated the task description. (Show Details)Jan 14 2026, 2:08 PM

Dreamy_Jazz updated the task description. (Show Details)

Dreamy_Jazz added a subscriber: STran.

We shouldn't be making DB calls in the validator. There is a suggestion to do it in a provider so that it's cached and doesn't happen more than once per request

At the moment it seems we repeat multiple DB calls per title we validate for each Reply tool button, which are not cached in PHP

Potential DDoS vector - I've seen replica DBs lag due to the issue in logstash

Dreamy_Jazz added a project: Vuln-DoS.Jan 14 2026, 2:42 PM

STran claimed this task.Jan 14 2026, 2:49 PM

Urbanecm_WMF added subscribers: Michael, EMcFarland-WMF, Sgs and 5 others.Jan 14 2026, 2:55 PM

STran mentioned this in rEREIfcc9ec2e6068: Only validate IRS configs on writes; skip validations for reads.Jan 14 2026, 4:32 PM

Dreamy_Jazz mentioned this in rEREI5c4e7dc67b08: Only validate IRS configs on writes; skip validations for reads.Jan 14 2026, 4:35 PM

Dreamy_Jazz mentioned this in rEREIe9537cd03227: Only validate IRS configs on writes; skip validations for reads.Jan 14 2026, 4:37 PM

Patch is backported. cc @sbassett is it ok to make this task public? Thanks!

Dreamy_Jazz moved this task from Backlog to Done on the Product Safety and Integrity (Essential Work Sprint (Dec 15th - Jan 9th)) board.Jan 20 2026, 10:45 AM

In T414582#11522158, @STran wrote:

Patch is backported. cc @sbassett is it ok to make this task public? Thanks!

Sure. Was this issue only ever on master? If not, then we should try to backport to supported release branches as well where the bug was relevant.

master patch: https://gerrit.wikimedia.org/r/1226884

sbassett triaged this task as Low priority.Jan 20 2026, 3:47 PM

sbassett changed Author Affiliation from N/A to WMF Product.

sbassett changed the visibility from "Custom Policy" to "Public (No Login Required)".

sbassett changed Risk Rating from N/A to Low.

sbassett mentioned this in T411394: Write and send supplementary release announcement for extensions and skins with security patches (1.43.7/1.44.4/1.45.2).Jan 20 2026, 10:21 PM

In T414582#11537930, @sbassett wrote:

Sure. Was this issue only ever on master? If not, then we should try to backport to supported release branches as well where the bug was relevant.

master patch: https://gerrit.wikimedia.org/r/1226884

I'm unfamiliar with the Incident-Reporting-System code, but it looks like the function being modified by that patch may have been introduced in https://gerrit.wikimedia.org/r/c/mediawiki/extensions/ReportIncident/+/1105680; ie., in (what's now) the REL1_44 branch.

In T414582#11555965, @A_smart_kitten wrote:

In T414582#11537930, @sbassett wrote:

Sure. Was this issue only ever on master? If not, then we should try to backport to supported release branches as well where the bug was relevant.

master patch: https://gerrit.wikimedia.org/r/1226884

I'm unfamiliar with the Incident-Reporting-System code, but it looks like the function being modified by that patch may have been introduced in https://gerrit.wikimedia.org/r/c/mediawiki/extensions/ReportIncident/+/1105680; ie., in (what's now) the REL1_44 branch.

The issue was added in 7d6d26fcf6af093346e59b1c7c0756480f17f9d0 when uncached DB queries were added

In T414582#11557168, @Dreamy_Jazz wrote:

The issue was added in 7d6d26fcf6af093346e59b1c7c0756480f17f9d0 when uncached DB queries were added

Ok, then that confirms it was only on master.

ASanford-WMF renamed this task from ReportIncident DiscussionTools integration causes slow requests with occasional timeouts on large talk pages to CVE-2026-5762: ReportIncident DiscussionTools integration causes slow requests with occasional timeouts on large talk pages.Apr 7 2026, 6:43 PM

CVE-2026-5762: ReportIncident DiscussionTools integration causes slow requests with occasional timeouts on large talk pagesClosed, ResolvedPublicSecurityActions