What’s Vulnerable › Vulnerabilities

CVE-2014-125127: Denial of Service (DoS) vulnerability in mikecao/flight

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-09-03 · updated 2026-06-17
• Weakness: CWE-770

Description

The mikecao/flight PHP framework in versions prior to v1.2 is vulnerable to Denial of Service (DoS) attacks due to eager loading of request bodies in the Request class constructor. The framework automatically reads the entire request body on every HTTP request, regardless of whether the application needs it. An attacker can exploit this by sending requests with large payloads, causing excessive memory consumption and potentially exhausting available server memory, leading to application crashes or service unavailability. The vulnerability was fixed in v1.2 by implementing lazy loading of request bodies.

Affected products

• flightphp Flight: before 1.2 — fixed in 1.2

How to fix

Upgrade to a fixed version: flightphp Flight 1.2. Check the vendor advisory for mitigations.

References

• https://github.com/Checkmarx/Vulnerabilities-Proofs-of-Concept/tree/main/2014/CVE-2014-125127
• https://github.com/mikecao/flight/commit/da40e03eb4a39745107912dffe926a8fce0d38dc
• https://github.com/mikecao/flight/pull/125
• https://github.com/Checkmarx/Vulnerabilities-Proofs-of-Concept/tree/main/2014/CVE-2014-125127

Get alerted when CVE-2014-125127 or the next vulnerability affects your stack