CVE-2026-111901: phpMyFAQ 4.2.0-alpha before 4.2.0-beta Unauthenticated DoS via API Pagination

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-17 · updated 2026-10-19
Weakness: CWE-400

Description

phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an uncontrolled resource consumption vulnerability in the unauthenticated faqs and search API endpoints. Attackers can send concurrent GET requests that load and process all database records into PHP memory, exhausting CPU and memory to crash the server.

Affected products

thorsten phpMyFAQ: from 4.2.0-alpha before 4.2.0-beta — fixed in 4.2.0-beta

How to fix

Upgrade to a fixed version: thorsten phpMyFAQ 4.2.0-beta. Check the vendor advisory for mitigations.

References

https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-m42f-6p37-2c79
https://www.vulncheck.com/advisories/phpmyfaq-4.2.0-alpha-before-4.2.0-beta-unauthenticated-dos-via-api-pagination
https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-m42f-6p37-2c79

Get alerted when CVE-2026-111901 or the next vulnerability affects your stack