CVE-2023-29141: Fedoraproject Fedora

Critical severity, CVSS 9.8. EPSS: 1.2% chance of exploitation in the next 30 days.

An issue was discovered in MediaWiki before 1.35.10, 1.36.x through 1.38.x before 1.38.6, and 1.39.x before 1.39.3. An auto-block can occur for an untrusted X-Forwarded-For header.

Affected products

• Fedoraproject Fedora: version 37 only
• Mediawiki Mediawiki: before 1.35.10 (fixed in 1.35.10); from 1.36.0, before 1.38.6 (fixed in 1.38.6); from 1.39.0, before 1.39.3 (fixed in 1.39.3)

Published 2023-03-31. Last modified 2026-06-17.