Skip to content
Heist/ feed
Back to feed
High

phpMyFAQ 4.2.0-alpha before 4.2.0-beta Unauthenticated DoS via API Pagination

Type: advisorySources: OSV

phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an uncontrolled resource consumption vulnerability in the unauthenticated faqs and search API endpoints. Attackers can send concurrent GET requests that load and process all database records into PHP memory, exhausting CPU and memory to crash the server.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-111901
Confirmed fixed CVEs
Not specified
Updated in this feed
7 Nov 2026, 03:16 UTC · Revision 1

Source evidence

phpMyFAQ 4.2.0-alpha before 4.2.0-beta Unauthenticated DoS via API Pagination

core-osv · Original source

Published 17 Oct 2026, 18:46 UTC

phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an uncontrolled resource consumption vulnerability in the unauthenticated faqs and search API endpoints. Attackers can send concurrent GET requests that load and process all database records into PHP memory, exhausting CPU and memory to crash the server.

osv:CVE-2026-111901
Complete source record
{
  "id": "f03d2314fe22bef787944d730391df43f251962f54acf6c0b527fa79668064e8",
  "url": "https://osv.dev/vulnerability/CVE-2026-111901",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "phpMyFAQ 4.2.0-alpha before 4.2.0-beta Unauthenticated DoS via API Pagination",
    "summary": "phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an uncontrolled resource consumption vulnerability in the unauthenticated faqs and search API endpoints. Attackers can send concurrent GET requests that load and process all database records into PHP memory, exhausting CPU and memory to crash the server.",
    "evidence": "osv:CVE-2026-111901",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2026-111901",
      "aliases": [
        "CVE-2026-111901",
        "GHSA-m42f-6p37-2c79"
      ],
      "metrics": [
        {
          "type": "CVSS_V4",
          "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/thorsten/phpmyfaq",
              "type": "GIT",
              "events": [
                {
                  "introduced": "a429fb81a4efe1f7c0aeec5b7bf8a98a50509b85"
                },
                {
                  "fixed": "e137c1e017b15ffa01181a2380b81e1aea5ae1ad"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "4.2.0-alpha"
                      },
                      {
                        "fixed": "4.2.0-beta"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                  },
                  {
                    "range": [
                      {
                        "introduced": "4.2.0-alpha"
                      },
                      {
                        "fixed": "4.2.0-beta"
                      }
                    ],
                    "source": "DESCRIPTION"
                  }
                ]
              }
            }
          ],
          "versions": [
            "development-nightly-2026-10-03",
            "4.1-nightly-2026-10-03",
            "development-nightly-2026-10-02",
            "4.1-nightly-2026-10-02",
            "development-nightly-2026-10-01",
            "development-nightly-2026-09-30",
            "4.1-nightly-2026-10-01",
            "4.1-nightly-2026-09-30",
            "development-nightly-2026-09-29",
            "4.1-nightly-2026-09-29",
            "development-nightly-2026-09-28",
            "4.1-nightly-2026-09-28",
            "development-nightly-2026-09-27",
            "development-nightly-2026-09-26",
            "development-nightly-2026-09-25",
            "4.1-nightly-2026-09-27",
            "4.1-nightly-2026-09-26",
            "4.1-nightly-2026-09-25",
            "development-nightly-2026-09-24",
            "4.1-nightly-2026-09-24",
            "development-nightly-2026-09-23",
            "4.1-nightly-2026-09-23",
            "development-nightly-2026-09-22",
            "4.1-nightly-2026-09-22",
            "development-nightly-2026-09-21",
            "4.1-nightly-2026-09-21",
            "development-nightly-2026-09-20",
            "4.1-nightly-2026-09-20",
            "4.1-nightly-2026-09-18",
            "development-nightly-2026-09-17",
            "4.1-nightly-2026-09-17",
            "development-nightly-2026-09-16",
            "4.1-nightly-2026-09-16",
            "development-nightly-2026-09-15",
            "4.1-nightly-2026-09-15",
            "development-nightly-2026-09-14",
            "4.1-nightly-2026-09-14",
            "development-nightly-2026-09-13",
            "4.1-nightly-2026-09-13",
            "development-nightly-2026-09-12",
            "4.1-nightly-2026-09-12",
            "development-nightly-2026-09-11",
            "4.1-nightly-2026-09-11",
            "development-nightly-2026-09-10",
            "development-nightly-2026-09-09",
            "development-nightly-2026-09-08",
            "development-nightly-2026-09-07",
            "development-nightly-2026-09-06",
            "development-nightly-2026-09-05",
            "development-nightly-2026-09-04",
            "development-nightly-2026-09-03",
            "development-nightly-2026-09-02",
            "development-nightly-2026-09-01",
            "4.1-nightly-2026-09-10",
            "4.1-nightly-2026-09-09",
            "4.1-nightly-2026-09-08",
            "4.1-nightly-2026-09-07",
            "4.1-nightly-2026-09-06",
            "4.1-nightly-2026-09-05",
            "4.1-nightly-2026-09-04",
            "4.1-nightly-2026-09-03",
            "4.1-nightly-2026-09-02",
            "4.1-nightly-2026-09-01",
            "development-nightly-2026-08-31",
            "development-nightly-2026-08-30",
            "development-nightly-2026-08-29",
            "development-nightly-2026-08-28",
            "development-nightly-2026-08-27",
            "development-nightly-2026-08-26",
            "development-nightly-2026-08-25",
            "development-nightly-2026-08-24",
            "4.1-nightly-2026-08-31",
            "4.1-nightly-2026-08-30",
            "4.1-nightly-2026-08-29",
            "4.1-nightly-2026-08-28",
            "4.1-nightly-2026-08-27",
            "4.1-nightly-2026-08-26",
            "4.1-nightly-2026-08-25",
            "4.1-nightly-2026-08-24",
            "development-nightly-2026-08-21",
            "4.1-nightly-2026-08-21",
            "4.2.0-alpha.2",
            "development-nightly-2026-08-20",
            "4.1-nightly-2026-08-20",
            "development-nightly-2026-08-19",
            "4.1-nightly-2026-08-19",
            "development-nightly-2026-08-18",
            "4.1-nightly-2026-08-18",
            "development-nightly-2026-08-17",
            "4.1-nightly-2026-08-17",
            "development-nightly-2026-08-16",
            "4.1-nightly-2026-08-16",
            "development-nightly-2026-08-15",
            "development-nightly-2026-08-14",
            "4.1-nightly-2026-08-15",
            "4.1-nightly-2026-08-14",
            "development-nightly-2026-08-13",
            "4.1-nightly-2026-08-13",
            "development-nightly-2026-08-12",
            "4.1-nightly-2026-08-12",
            "development-nightly-2026-08-11",
            "4.1-nightly-2026-08-11",
            "development-nightly-2026-08-10",
            "development-nightly-2026-08-09",
            "4.1-nightly-2026-08-10",
            "4.1-nightly-2026-08-09",
            "4.2.0-alpha"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111901.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:49.309223755Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111901.json",
        "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-m42f-6p37-2c79",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-111901",
        "https://www.vulncheck.com/advisories/phpmyfaq-4.2.0-alpha-before-4.2.0-beta-unauthenticated-dos-via-api-pagination"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-400"
        ],
        "cna_assigner": "VulnCheck",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111901.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-111901",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 517679,
  "published_at": "2026-10-17T18:46:22.075+00:00"
}