CVE-2022-34750

An issue was discovered in MediaWiki through 1.38.1. The lemma length of a Wikibase lexeme is currently capped at a thousand characters. Unfortunately, this length is not validated, allowing much larger lexemes to be created, which introduces various denial-of-service attack vectors within the Wikibase and WikibaseLexeme extensions. This is related to Special:NewLexeme and Special:NewProperty.

• CWE-770

• https://gerrit.wikimedia.org/r/q/I8171bfef73e525d73efa60b407ce147130ea4742Vendor Advisory
• https://gerrit.wikimedia.org/r/q/Id89a9b08e40f075d2d422cafd03668dff3ce7fc9Vendor Advisory
• https://phabricator.wikimedia.org/T308659Mailing List
• https://gerrit.wikimedia.org/r/q/I8171bfef73e525d73efa60b407ce147130ea4742Vendor Advisory
• https://gerrit.wikimedia.org/r/q/Id89a9b08e40f075d2d422cafd03668dff3ce7fc9Vendor Advisory
• https://phabricator.wikimedia.org/T308659Mailing List

Published

Jun 28, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-34742The system module has a read/write vulnerability. Successful…7.5
• CVE-2022-34743The AT commands of the USB port have an out-of-bounds read v…7.5
• CVE-2022-34746An insufficient entropy vulnerability caused by the improper…5.9
• CVE-2022-34747A format string vulnerability in Zyxel NAS326 firmware versi…9.8
• CVE-2022-34748A vulnerability has been identified in Simcenter Femap (All …7.8
• CVE-2022-34749In mistune through 2.0.2, support of inline markup is implem…7.5
• CVE-2022-34753A CWE-78: Improper Neutralization of Special Elements used i…8.8
• CVE-2022-34754A CWE-269: Improper Privilege Management vulnerability exist…6.8
• CVE-2022-34755 A CWE-427 - Uncontrolled Search Path Element vulnerability …6.7
• CVE-2022-34756A CWE-120: Buffer Copy without Checking Size of Input vulner…9.8
• CVE-2022-34757A CWE-327: Use of a Broken or Risky Cryptographic Algorithm …5.3
• CVE-2022-34758A CWE-20: Improper Input Validation vulnerability exists tha…4.9