{"id":"CVE-2026-111901","kind":"vulnerability","aliases":["CVE-2026-111901"],"related":[],"title":"phpMyFAQ: unauthenticated API requests exhaust memory and crash the server","description":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an uncontrolled resource consumption vulnerability in the unauthenticated faqs and search API endpoints. Attackers can send concurrent GET requests that load and process all database records into PHP memory, exhausting CPU and memory to crash the server.","summary":"phpMyFAQ 4.2.0-alpha (before 4.2.0-beta) paginates GET /api/v4.0/faqs and /api/v4.0/search in PHP instead of SQL. Each unauthenticated request loads all FAQs into memory, so concurrent requests exhaust CPU and memory and can crash PHP-FPM. Impact is small on databases with only a few hundred FAQs.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"phpmyfaq/phpmyfaq","fixed":["4.2.0-beta"],"affected":">= 4.2.0-alpha, < 4.2.0-beta","ecosystem":"composer"}],"ecosystems":[],"tags":["package","php","phpmyfaq","self-hosted"],"not_affected_if":["api-blocked","managed-hosting","stable-release","version-outside-4.2.0-alpha-range"],"how_to_check":"Run 4.2.0-alpha? Check the version in the admin panel or in composer.json/src/phpMyFAQ/System.php. Stable 3.x/4.0/4.1 are not listed as affected. Test: curl -s -o /dev/null -w '%{time_total}' https://YOURSITE/api/v4.0/faqs. Multi-second responses on a large FAQ set mean you are exposed.","fix":"Move to 4.2.0-beta or later. If you cannot, rate-limit or block /api/v4.0/faqs and /api/v4.0/search at the reverse proxy, or move to the stable 4.1.x line.","status":"open","published_at":"2026-10-17T19:16:31+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-23T22:37:35+00:00","updated_at":"2026-10-24T00:23:36+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T22:37:35Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade phpMyFAQ to 4.2.0-beta or later.","reach":"internet","title":"phpMyFAQ: unauthenticated API requests exhaust memory and crash the server","impact":"low","summary":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta lets anyone send concurrent GET requests to the faqs and search API endpoints, which load every database record into PHP memory. An attacker can exhaust CPU and memory and crash the server, causing denial of service.","category":"package","who_cares":["phpmyfaq","php","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Server crashes from memory and CPU exhaustion; denial of service only","analyst_note":"Confirm the exact affected version range and whether a patched release beyond 4.2.0-beta exists, checking the NVD entry and the phpMyFAQ release notes.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["version-outside-4.2.0-alpha-range"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000495,"input_tokens":2933,"output_tokens":403,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the exact affected version range and whether a patched release beyond 4.2.0-beta exists, checking the NVD entry and the phpMyFAQ release notes.","search":"'-111901':13A,16A '-2026':12A,15A '/api/v4.0/faqs':32B '/api/v4.0/search':34B '4.2.0':25B,28B,73C,76C 'alpha':26B,74C 'api':3A,90C 'attack':92C 'beta':29B,77C 'concurr':49B,95C 'consumpt':82C 'contain':78C 'cpu':52B,109C 'crash':8A,57B,113C 'cve':11A,14A 'databas':65B,103C 'endpoint':91C 'exhaust':5A,51B,108C 'faq':45B,71B,87C 'fpm':60B 'get':31B,96C 'host':23B 'hundr':70B 'impact':61B 'instead':37B 'load':43B,99C 'memori':6A,47B,54B,107C,111C 'packag':18B 'pagin':30B 'php':19B,36B,59B,106C 'php-fpm':58B 'phpmyfaq':1A,20B,24B,72C 'phpmyfaq/phpmyfaq':17A 'process':101C 'record':104C 'request':4A,42B,50B,97C 'resourc':81C 'search':89C 'self':22B 'self-host':21B 'send':94C 'server':10A,115C 'small':63B 'sql':39B 'unauthent':2A,41B,86C 'uncontrol':80C 'vulner':83C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-17T19:16:31+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111901","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111901","severity":null,"published_at":"2026-10-17T19:16:31+00:00","modified_at":"2026-10-19T15:16:55+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-111901:652","url":null,"severity":null,"published_at":"2026-10-24T00:23:36+00:00","modified_at":"2026-10-24T00:23:36+00:00","first_seen_at":"2026-10-24T00:23:36+00:00","fetched_at":"2026-10-24T00:23:36+00:00","note":"Read GHSA-m42f-6p37-2c79 (vendor) and CVE record. Affected 4.2.0-alpha up to 4.2.0-beta (GHSA lists <4.2.0-alpha.2 and 4.2.0-beta). No later release page found; 4.2.0-beta not seen on GitHub releases page (only nightlies), so a beta tag is unconfirmed. Not exploited per vendor/CVE; a Volerion page claims in-the-wild exploitation with no evidence, ignored. PoC is in the GHSA. Skipped X search (niche). Stable 4.1.x and earlier are not affected."}],"documents":[{"id":2583,"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-m42f-6p37-2c79","title":"GHSA-m42f-6p37-2c79: phpMyFAQ unauthenticated DoS via API pagination","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2584,"url":"https://www.cve.org/CVERecord?id=CVE-2026-111901","title":"CVE Record CVE-2026-111901","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}