{"id":"CVE-2026-104454","published":"2026-10-02T12:17:17.160","lastModified":"2026-10-02T15:17:07.570","description":"YesWiki before 4.6.7 contains an algorithmic-complexity denial of service in the wakka.php formatter due to an O(n^2) markdown-link regex. Unauthenticated attackers can submit a small crafted body of bracket characters to the page-edit preview endpoint to pin PHP-FPM workers and saturate the pool.","cvssScore":5.3,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","cwes":["CWE-1333"],"vendors":[],"products":[],"references":[{"url":"https://github.com/YesWiki/yeswiki/security/advisories/GHSA-gf57-wg5m-h34q","tags":[]},{"url":"https://www.vulncheck.com/advisories/yeswiki-before-4.6.7-redos-via-wakka-php-edit-preview-endpoint","tags":[]},{"url":"https://github.com/YesWiki/yeswiki/security/advisories/GHSA-gf57-wg5m-h34q","tags":[]}],"exploitRefs":[{"url":"https://github.com/YesWiki/yeswiki/security/advisories/GHSA-gf57-wg5m-h34q","tags":[]},{"url":"https://github.com/YesWiki/yeswiki/security/advisories/GHSA-gf57-wg5m-h34q","tags":[]}],"hasPoc":true,"ai":null}