High priorityDisclosed

Advisory · CVE-2026-111901

Unauthenticated phpMyFAQ API endpoints can be flooded to exhaust the server

phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an uncontrolled resource consumption flaw in its unauthenticated faqs and search API endpoints, which load all database records into memory and can be flooded to exhaust CPU and memory. CVSS 4.0 8.7 (CVSS 3.1 7.5).

Advisory published October 17, 2026Independent summary
Vendor
phpMyFAQ
Product
phpMyFAQ
Identifier / CWE
CVE-2026-111901
CWE-400
Action timing
Immediate
ELI5

Explain it like I’m five

Two public API doors answer every knock by carrying the entire database into memory, so enough knocks at once knock the server over.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01Public endpoints called

    An unauthenticated attacker sends concurrent GET requests to the faqs and search API endpoints.

  2. 02All records loaded

    Each request loads and processes all database records into PHP memory without effective pagination limits.

  3. 03Server exhausted

    CPU and memory are consumed until the server crashes or becomes unresponsive.

What happened

The phpMyFAQ project disclosed CVE-2026-111901 for the 4.2.0-alpha line before 4.2.0-beta: an uncontrolled resource consumption flaw (CWE-400) in the unauthenticated faqs and search API endpoints, which load and process all database records into PHP memory.

Per the vendor affected data in the NVD record, 4.2.0-beta is the first unaffected release on that line. The record lists no affected stable release.

What to do

  1. Inventory phpMyFAQ instances, including staging, demo, and help-desk installs.
  2. Upgrade affected instances to 4.2.0-beta or later on the 4.2 line using the project release guidance.
  3. Restrict administrative and API access to trusted networks while remediation is underway.
  4. Hunt for bursts of concurrent requests to the faqs and search API endpoints and memory exhaustion events in PHP logs.
  5. Verify the deployed version after updating, not just that an update ran.

Management note

Pre-release lines in production carry pre-release risk. If a 4.2 alpha is internet-facing, move it to the fixed beta or put rate limiting in front of those endpoints today.