Live › vulnerability › CVE-2026-111901
Go to dashboardphpMyFAQ 4.2.0-alpha (before 4.2.0-beta) paginates GET /api/v4.0/faqs and /api/v4.0/search in PHP instead of SQL. Each unauthenticated request loads all FAQs into memory, so concurrent requests exhaust CPU and memory and can crash PHP-FPM. Impact is small on databases with only a few hundred FAQs.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| phpmyfaq/phpmyfaq | composer | >= 4.2.0-alpha, < 4.2.0-beta | 4.2.0-beta |
%{time_total} https://YOURSITE/api/v4.0/faqs4.2.0-beta or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an uncontrolled resource consumption vulnerability in the unauthenticated faqs and search API endpoints. Attackers can send concurrent GET requests that load and process all database records into PHP memory, exhausting CPU and memory to crash the server.
This page as .md · .json · in your agent: get_signal("CVE-2026-111901")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.