ReDoS in DynamicPageList3
Priority LOW 35CWE-400Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-400.
Summary
The DynamicPageList3 extension is a reporting tool for MediaWiki, listing category members and intersections with various formats and details. In affected versions unsanitised input of regular expression date within the parameters of the DPL parser function, allowed for the possibility of ReDoS (Regex Denial of Service). This has been resolved in version 3.3.6. If you are unable to update you may also set `$wgDplSettings['functionalRichness'] = 0;` or disable DynamicPageList3 to mitigate.
Why it matters now
EPSS 0.01158 67th percentileScored 2026-11-07
Fix Fixed DynamicPageList3 (Universal-Omega): 3.3.6
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Universal-Omega | DynamicPageList3 | before 3.3.6 | 3.3.6 | Patch available | CNA |
- DynamicPageList3 VendorUniversal-Omega Affected before 3.3.6 Fixed in 3.3.6 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:dynamicpagelist3_project:dynamicpagelist3:*:*:*:*:*:mediawiki:*:* | before 3.3.6 | Vulnerable | Dynamicpagelist3 Project |
- cpe:2.3:a:dynamicpagelist3_project:dynamicpagelist3:*:*:*:*:*:mediawiki:*:* Versions before 3.3.6 Vulnerable ·Dynamicpagelist3 Project
Remediation
- Fix · CNA DynamicPageList3 (Universal-Omega) Fixed in 3.3.6
Timeline
- 2026-10-02 Threatist record created from CVE-2021-41118
References
More Universal-Omega vulnerabilities
- TI-2025-33552 DynamicPageList3 exposes hidden/suppressed usernames CVSS 4.0HIGH 8.7
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences