CVE-2026-111901: phpMyFAQ 4.2.0-alpha before 4.2.0-beta Unauthenticated DoS via API Pagination
phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an uncontrolled resource consumption vulnerability in the unauthenticated faqs and search API endpoints. Attackers can send concurrent GET requests that load and process all database records into PHP memory, exhausting CPU and memory to crash the server.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments running phpMyFAQ 4.2.0-alpha are affected. The vulnerable API endpoints are unauthenticated, so any instance where an attacker can reach the faqs or search API endpoints is exposed.
What does an attacker need to exploit this issue?
No authentication or user interaction is required. An attacker can send concurrent GET requests to the affected API endpoints, causing all database records to be loaded and processed in PHP memory.
What is the practical impact?
Concurrent requests can exhaust server CPU and memory, causing the phpMyFAQ server to crash. The provided impact information identifies availability impact only; confidentiality and integrity impacts are not indicated.
How can this be remediated or mitigated?
Update from 4.2.0-alpha to 4.2.0-beta or a later available version. If updating cannot occur immediately, restrict or rate-limit access to the unauthenticated faqs and search API endpoints to reduce exposure to concurrent requests.