CVE-2025-61641: 
NixOS vulnerability analysis and mitigation

CVE-2025-61641 is a Denial of Service (DoS) vulnerability in Wikimedia Foundation MediaWiki, specifically associated with the includes/api/ApiQueryAllPages.php file. It affects MediaWiki versions before 1.39.14, versions 1.43.0 through 1.43.3, and version 1.44.0. The vulnerability was published on February 3, 2026, and carries a CVSS v3.1 base score of 6.1 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The vulnerability is classified under CWE-770 (Allocation of Resources Without Limits or Throttling) and CWE-22 (Path Traversal), with the primary concern being the lack of resource throttling in the ApiQueryAllPages API endpoint. When the list=allpages API is called with a maximum size parameter (maxsize), it can trigger extremely slow database queries that consume excessive server resources. The attack vector is network-based, requires no authentication (PR:N), but does require user interaction (UI:R) per the CVSS v3.1 scoring, suggesting the attack may be triggered via a crafted link or request (Red Hat Bugzilla, Infinit Sec).

Successful exploitation can degrade or deny availability of the MediaWiki instance by causing the server to execute resource-intensive database queries, potentially exhausting server-side resources. The CVSS v3.1 scoring indicates low confidentiality and integrity impact alongside the availability concern, meaning attackers could also leverage the changed scope (S:C) to affect components beyond the vulnerable API itself. Large public wikis or those with limited server resources are most at risk of service disruption (Red Hat Advisory).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported for CVE-2025-61641. The EPSS score is approximately 0.052% (0.000520), indicating a very low probability of exploitation in the near term. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been identified (Red Hat Advisory).

1. Reconnaissance: Identify a publicly accessible MediaWiki instance running a vulnerable version (before 1.39.14, 1.43.0–1.43.3, or 1.44.0) using version disclosure in page footers or the Special:Version page.
2. Craft malicious API request: Construct an HTTP GET or POST request targeting the MediaWiki API endpoint with action=query&list=allpages and a large or specially crafted maxsize parameter designed to trigger a slow database query.
3. Send repeated requests: Submit multiple such requests in rapid succession to amplify resource exhaustion on the server, causing degraded response times or a denial of service condition.
4. Observe impact: Monitor the target wiki for slow responses, timeouts, or HTTP 503 errors indicating successful resource exhaustion (Infinit Sec, Red Hat Bugzilla).

• Network: Unusually high volume of HTTP requests to /api.php with parameters action=query&list=allpages and large maxsize values from a single or small set of IP addresses.
• Logs: MediaWiki or web server access logs showing repeated slow or timed-out API queries targeting the allpages list endpoint; database slow query logs showing repeated expensive queries originating from the MediaWiki API.
• Application: Elevated server CPU or memory usage correlated with API query traffic; increased database query execution times for allpages-related queries.

MediaWiki has released patched versions addressing this vulnerability: 1.39.14, 1.43.4, and 1.44.1. Administrators should upgrade to one of these versions as the primary remediation. As a temporary workaround, rate-limiting API requests at the web server or reverse proxy level (e.g., via nginx or Apache) can reduce exposure until an upgrade is feasible. Debian LTS and Mageia have also released updated packages for their respective distributions (Debian LTS Announce, Debian Security Announce, Red Hat Bugzilla).

A technical blog post by a MediaWiki developer (bawolff) discussed XSS protector effectiveness in the context of MediaWiki security improvements around the same period, though not exclusively focused on this CVE. Debian and Mageia issued security advisories and updated packages, reflecting standard downstream response. No significant social media discussion or high-profile researcher commentary specific to CVE-2025-61641 has been identified (bawolff blog, Debian LTS Announce).