CVE-2025-11175: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-11175 is an Expression Language Injection vulnerability (CWE-917) in the Wikimedia Foundation's MediaWiki DiscussionTools Extension that enables Regular Expression Exponential Blowup (ReDoS). It affects DiscussionTools Extension versions 1.43 and 1.44. The vulnerability was published on January 30, 2026, and carries a CVSS v4.0 base score of 8.8 (High) (Red Hat CVE, ENISA EUVD).

The root cause is improper neutralization of special elements in expression language statements (CWE-917) within the DiscussionTools Extension's regular expression handling logic. An attacker can craft malicious input that triggers catastrophic backtracking in the regex engine — a technique known as Regular Expression Exponential Blowup (ReDoS) — causing the server-side processing to consume excessive CPU resources. The attack requires no authentication, no user interaction, and no special preconditions beyond network access to a vulnerable MediaWiki instance. Patch references are available via Wikimedia's Gerrit code review system (Phabricator T396248, Gerrit patch).

Successful exploitation can result in high confidentiality impact and low integrity impact on the vulnerable MediaWiki instance, with no direct availability impact per the CVSS v4.0 scoring. The ReDoS attack vector can degrade server performance by monopolizing CPU resources during regex evaluation, potentially affecting service responsiveness for other users. Additionally, the expression language injection component may allow unauthorized access to sensitive information and limited data modification (Red Hat CVE, ENISA EUVD).

As of the time of reporting, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Red Hat CVE). The vulnerability has an EPSS score of approximately 0.016% (0.000160), indicating a low probability of exploitation in the near term. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Reconnaissance: Identify publicly accessible MediaWiki instances running DiscussionTools Extension versions 1.43 or 1.44 using web search, Shodan, or by inspecting MediaWiki version disclosure pages.
2. Identify injection point: Locate input fields or API endpoints within the DiscussionTools Extension that process user-supplied text through expression language or regex evaluation (e.g., discussion thread parsing endpoints).
3. Craft malicious payload: Construct an input string designed to trigger catastrophic backtracking in the server-side regex engine — for example, a deeply nested or ambiguous pattern such as (a+)+, ([a-zA-Z]+)*, or similar ReDoS-triggering constructs embedded within expression language syntax.
4. Submit payload: Send the crafted input to the vulnerable endpoint via HTTP request (unauthenticated, no user interaction required).
5. Observe impact: Monitor for server-side CPU exhaustion or degraded response times, indicating successful ReDoS triggering; optionally leverage the expression language injection aspect to probe for information disclosure (Phabricator T396248, Infinitsec writeup).

• Network: Repeated or high-volume HTTP requests to MediaWiki DiscussionTools API endpoints from a single or small set of IP addresses; unusually long request processing times on discussion-related endpoints.
• Logs: MediaWiki access logs showing requests with abnormally long or complex input strings in discussion-related parameters; server error logs indicating regex timeout or excessive CPU usage during request handling.
• Process: Elevated CPU utilization on the MediaWiki/PHP server process sustained over time without corresponding legitimate traffic spikes; PHP worker processes stuck in regex evaluation.

Organizations should apply the patches available via Wikimedia's Gerrit code review system for the DiscussionTools Extension (Gerrit patch I563219f, Gerrit patch I126203a). A Debian security advisory (DSA-6085-1) has also been issued covering MediaWiki updates including this CVE (Debian Security Announce). As an interim workaround, administrators may consider disabling the DiscussionTools Extension entirely if patching is not immediately feasible, and should restrict network access to MediaWiki installations where possible. Monitor for suspicious regex-heavy requests targeting discussion endpoints.

A technical blog post from Infinitsec titled "CVE-2025-11175 - DiscussionTools Should Use Better Regex" provides analysis of the vulnerability (Infinitsec writeup). Debian issued a security advisory (DSA-6085-1) addressing this and related MediaWiki CVEs (Debian Security Announce). Red Hat has also tracked the vulnerability in their CVE database (Red Hat CVE). General community coverage has been limited, consistent with the low EPSS score and absence of active exploitation.