CVE-2026-111901 Details
Description
phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an uncontrolled resource consumption vulnerability in the unauthenticated faqs and search API endpoints. Attackers can send concurrent GET requests that load and process all database records into PHP memory, exhausting CPU and memory to crash the server.
A denial-of-service vulnerability has been identified in phpMyFAQ versions 4.2.0-alpha prior to 4.2.0-beta. The issue arises in the unauthenticated FAQs and search API endpoints, where application-level pagination allows attackers to send concurrent GET requests. These requests load all database records into PHP memory, processing them in a way that exhausts CPU and memory resources, ultimately crashing the server.
The pagination logic should be refactored to use database-level constraints, such as 'LIMIT' and 'OFFSET', instead of application-level array slicing. Update the 'getAllFaqs()' and 'fetchAllFaqs()' methods to accept limit and offset parameters and apply them directly to the SQL queries. Introduce a separate 'count()' method to accurately retrieve the total number of records for pagination metadata without loading the actual rows.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 17, 2026CISA-ADP
Assessed Oct 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-m42f-6p37-2c79 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-m42f-6p37-2c79 | [email protected] | AdvisoryExploitRemedyVendor |
| https://www.vulncheck.com/advisories/phpmyfaq-4.2.0-alpha-before-4.2.0-beta-unauthenticated-dos-via-api-pagination | [email protected] | AdvisoryVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| phpMyFAQ | < 4.2.0-alpha.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 19, 2026 | CVE Modified | CISA-ADP |
| Oct 17, 2026 | New CVE Received | [email protected] |