CVE-2021-41800

MediaWiki before 1.36.2 allows a denial of service (resource consumption because of lengthy query processing time). Visiting Special:Contributions can sometimes result in a long running SQL query because PoolCounter protection is mishandled.

• CWE-770

• https://github.com/wikimedia/mediawiki/commit/781caf83dba90c18349f930bbaaa0e89f003f874Patch, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CJDYJQWT43GBD6GNQ4OW7JOZ6WQ6DZTN/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MDBPECBWN6LWNSWIQMVXK6PP4YFEUYHA/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QNEAI2T3Y65I55ZB6UE6RMC662RZTGRX/
• https://lists.wikimedia.org/hyperkitty/list/wikitech-l%40lists.wikimedia.org/thread/2IFS5CM2YV4VMSODPX3J2LFHKSEWVFV5/
• https://phabricator.wikimedia.org/T284419Permissions Required
• https://security.gentoo.org/glsa/202305-24
• https://github.com/wikimedia/mediawiki/commit/781caf83dba90c18349f930bbaaa0e89f003f874Patch, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CJDYJQWT43GBD6GNQ4OW7JOZ6WQ6DZTN/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MDBPECBWN6LWNSWIQMVXK6PP4YFEUYHA/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QNEAI2T3Y65I55ZB6UE6RMC662RZTGRX/
• https://lists.wikimedia.org/hyperkitty/list/wikitech-l%40lists.wikimedia.org/thread/2IFS5CM2YV4VMSODPX3J2LFHKSEWVFV5/
• https://phabricator.wikimedia.org/T284419Permissions Required
• https://security.gentoo.org/glsa/202305-24

Published

Oct 11, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-41795The Safari app extension bundled with 1Password for Mac 7.7.…6.5
• CVE-2021-41796Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-41797Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-41798MediaWiki before 1.36.2 allows XSS. Month related MediaWiki …6.1
• CVE-2021-41799MediaWiki before 1.36.2 allows a denial of service (resource…7.5
• CVE-2021-4180An information exposure flaw in openstack-tripleo-heat-templ…4.3
• CVE-2021-41801The ReplaceText extension through 1.41 for MediaWiki has Inc…8.8
• CVE-2021-41802HashiCorp Vault and Vault Enterprise through 1.7.4 and 1.8.3…5.4
• CVE-2021-41803HashiCorp Consul 1.8.1 up to 1.11.8, 1.12.4, and 1.13.1 do n…7.1
• CVE-2021-41805HashiCorp Consul Enterprise before 1.8.17, 1.9.x before 1.9.…8.8
• CVE-2021-41807Lack of rate limiting in M-Files Server and M-Files Web prod…9.8
• CVE-2021-41808In M-Files Server product with versions before 21.11.10775.0…2.3