phpMyFAQ: Uncontrolled resource consumption in FAQ and search API (DoS)
Summary
phpMyFAQ 4.2.0-alpha before 4.2.0-beta lets unauthenticated remote attackers exhaust CPU and memory through the FAQ listing and search API endpoints. The endpoints load all matching database records into PHP memory before applying pagination, so concurrent GET requests can crash the server or the PHP-FPM pool. The impact is limited to availability; no data disclosure or code execution is described. The CVSS 4.0 score is 8.7 (High), while some third-party scores are lower.
Affected
- phpMyFAQ 4.2.0-alpha up to but excluding 4.2.0-beta (CNA range)
- The vendor advisory lists affected versions below 4.2.0-alpha.2; verify the exact range in the advisory.
- Older branches such as 4.1.x are not listed as affected by this CVE.
Fixed in
- Upgrade to phpMyFAQ 4.2.0-beta or later.
Workaround
Unknown. No vendor workaround was identified. Rate limiting on /api/v4.0/faqs and /api/v4.0/search at a reverse proxy or WAF may reduce exposure, but it is not a vendor measure and must be tested first because it could also block legitimate users.
Exploitation
- Not known exploited; not listed in CISA KEV.
- CISA SSVC assessment: exploitation 'poc', automatable 'yes', technical impact 'partial'.
- No public proof of concept was found in the research; this is not confirmed absent.
Our recommendation
- Identify all phpMyFAQ instances and their exact versions.
- Upgrade any instance on 4.2.0-alpha or pre-release 4.2.0-beta builds to the fixed release.
- Check the vendor advisory and the GitHub releases page before deploying.
- Monitor public instances for unusual load or repeated requests to the API endpoints until patched.
- Review other phpMyFAQ security fixes in the same release window, as the upgrade covers them as well.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-m42f-6p37-2c79 github.com
- VulnCheck advisory: phpMyFAQ Unauthenticated DoS via API Pagination www.vulncheck.com
- VulDB CVE-2026-111901 vuldb.com
- Vulners CVE record (CVELIST) vulners.com
- HOL Guard CVE-2026-111901 hol.org
- EUVD-2026-103319 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 02:07.
Original description (NVD)
phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an uncontrolled resource consumption vulnerability in the unauthenticated faqs and search API endpoints. Attackers can send concurrent GET requests that load and process all database records into PHP memory, exhausting CPU and memory to crash the server.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.