---
id: "CVE-2026-111901"
kind: "vulnerability"
aliases: ["CVE-2026-111901"]
title: "phpMyFAQ: unauthenticated API requests exhaust memory and crash the server"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "phpmyfaq/phpmyfaq", "fixed": ["4.2.0-beta"], "affected": ">= 4.2.0-alpha, < 4.2.0-beta", "ecosystem": "composer"}]
ecosystems: []
tags: ["package", "php", "phpmyfaq", "self-hosted"]
not_affected_if: ["api-blocked", "managed-hosting", "stable-release", "version-outside-4.2.0-alpha-range"]
published_at: "2026-10-17T19:16:31+00:00"
first_seen_at: "2026-10-23T21:57:14+00:00"
updated_at: "2026-10-24T00:23:36+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111901", "first_seen_at": "2026-10-23T21:57:14+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-24T00:23:36+00:00"}]
---

# phpMyFAQ: unauthenticated API requests exhaust memory and crash the server

phpMyFAQ 4.2.0-alpha (before 4.2.0-beta) paginates GET /api/v4.0/faqs and /api/v4.0/search in PHP instead of SQL. Each unauthenticated request loads all FAQs into memory, so concurrent requests exhaust CPU and memory and can crash PHP-FPM. Impact is small on databases with only a few hundred FAQs.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- composer:phpmyfaq/phpmyfaq affected >= 4.2.0-alpha, < 4.2.0-beta fixed 4.2.0-beta

## How to check

Run 4.2.0-alpha? Check the version in the admin panel or in composer.json/src/phpMyFAQ/System.php. Stable 3.x/4.0/4.1 are not listed as affected. Test: curl -s -o /dev/null -w '%{time_total}' https://YOURSITE/api/v4.0/faqs. Multi-second responses on a large FAQ set mean you are exposed.

## Fix

Move to 4.2.0-beta or later. If you cannot, rate-limit or block /api/v4.0/faqs and /api/v4.0/search at the reverse proxy, or move to the stable 4.1.x line.

## Timeline

- 2026-10-23T21:57:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111901
- 2026-10-24T00:23:36+00:00 analyst — Read GHSA-m42f-6p37-2c79 (vendor) and CVE record. Affected 4.2.0-alpha up to 4.2.0-beta (GHSA lists <4.2.0-alpha.2 and 4.2.0-beta). No later release page found; 4.2.0-beta not seen on GitHub releases page (only nightlies), so a beta tag is unconfirmed. Not exploited per vendor/CVE; a Volerion page claims in-the-wild exploitation with no evidence, ignored. PoC is in the GHSA. Skipped X search (niche). Stable 4.1.x and earlier are not affected.

## Documents

- [advisory] GHSA-m42f-6p37-2c79: phpMyFAQ unauthenticated DoS via API pagination https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-m42f-6p37-2c79
- [describes] CVE Record CVE-2026-111901 https://www.cve.org/CVERecord?id=CVE-2026-111901

## From the sources

phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an uncontrolled resource consumption vulnerability in the unauthenticated faqs and search API endpoints. Attackers can send concurrent GET requests that load and process all database records into PHP memory, exhausting CPU and memory to crash the server.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_