CVE-2026-111901

phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an uncontrolled resource consumption vulnerability in the unauthenticated faqs and search API endpoints. Attackers can send concurrent GET requests that load and process all database records into PHP memory, exhausting CPU and memory to crash the server.

CVSS 4.0

8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.4% chance of exploitation in the next 30 days; higher than 35% of CVEs (scores of 2026-10-25)

CWE

CWE-400

Published

2026-10-17

Modified

2026-10-19

Record from

the NVD, synced 2026-10-19

References

• https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-m42f-6p37-2c79
• https://www.vulncheck.com/advisories/phpmyfaq-4.2.0-alpha-before-4.2.0-beta-unauthenticated-dos-via-api-pagination
• https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-m42f-6p37-2c79

Check your stackJSON