CVE-2025-61766

Bucket is a MediaWiki extension to store and retrieve structured data on articles. Prior to version 1.0.0, infinite recursion can occur if a user queries a bucket using the `!=` comparator. This will result in PHP's call stack limit exceeding, and/or increased memory consumption, potentially leading to a denial of service. Version 1.0.0 contains a patch for the issue.

• CWE-674

• https://github.com/weirdgloop/mediawiki-extensions-Bucket/blob/ad704120a1660b5929fb5825db1cf85c9c77acf4/includes/Expression/MemberOfExpression.php#L34
• https://github.com/weirdgloop/mediawiki-extensions-Bucket/commit/6f4a71d531cb802cdb991d2a4ca7bf8fb691defd
• https://github.com/weirdgloop/mediawiki-extensions-Bucket/security/advisories/GHSA-r9f2-4jh3-659j

Published

Oct 6, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-61760Vulnerability in the Oracle VM VirtualBox product of Oracle …7.5
• CVE-2025-61761Vulnerability in the PeopleSoft Enterprise FIN Maintenance M…5.4
• CVE-2025-61762Vulnerability in the PeopleSoft Enterprise FIN Payables prod…6.3
• CVE-2025-61763Vulnerability in Oracle Essbase (component: Essbase Web Plat…8.1
• CVE-2025-61764Vulnerability in the Oracle WebLogic Server product of Oracl…5.3
• CVE-2025-61765python-socketio is a Python implementation of the Socket.IO …6.4
• CVE-2025-61768KUNO CMS is a fully deployable full-stack blog application. …5.1
• CVE-2025-61769Emlog is an open source website building system. A cross-sit…6.1
• CVE-2025-6177Privilege Escalation in MiniOS in Google ChromeOS (16063.45.…7.4
• CVE-2025-61770Rack is a modular Ruby web server interface. In versions pri…7.5
• CVE-2025-61771Rack is a modular Ruby web server interface. In versions pri…7.5
• CVE-2025-61772Rack is a modular Ruby web server interface. In versions pri…7.5