AIKIDO-2026-29147

TL;DR

LegacyParser recurses into every nested <q> subquery before it applies $smwgQMaxDepth. A deeply nested query, including a long chain of explicit AND, uses CPU and memory on one request worker and can overflow the call stack. The public action=ask API accepts that query without a login. The fix checks the depth limit before each recursive call and caps recursion for stack safety.