CVE-2026-111901

7.5High

Published 17 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

7.5High

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: High impact on availability
Weakness: CWE-400

Impact

Remote, unauthenticated attackers can crash the server and cause a denial of service via concurrent requests to public API endpoints. They only need network access to reach the faqs and search routes.

Root cause

The unauthenticated faqs and search API endpoints load all database records into PHP memory simultaneously without proper pagination or limit controls.

Affected systems

phpMyFAQ 4.2.0-alpha before 4.2.0-beta

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Fix & remediation

Upgrade to phpMyFAQ 4.2.0-beta or later. As an interim workaround, rate-limit or block incoming unauthenticated requests to the /api faqs and search endpoints via your reverse proxy or web server configuration.

shell

$ composer update phpmyfaq/phpmyfaq

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an uncontrolled resource consumption vulnerability in the unauthenticated faqs and search API endpoints. Attackers can send concurrent GET requests that load and process all database records into PHP memory, exhausting CPU and memory to crash the server.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-111901