CVE-2026-111901CWE-400denial-of-service

CVE-2026-111901

High · published October 17, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
26.6
In the wild
Unconfirmed
What it is

phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an uncontrolled resource consumption vulnerability in the unauthenticated faqs and search API endpoints. Attackers can send concurrent GET requests that load and process all database records into PHP memory, exhausting CPU and memory to crash the server.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00343 · 26.6th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2026-10-17T23:16Z
References (3)
https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-m42f-6p37-2c79 · [email protected]https://www.vulncheck.com/advisories/phpmyfaq-4.2.0-alpha-before-4.2.0-beta-unauthenticated-dos-via-api-pagination · [email protected]https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-m42f-6p37-2c79 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 19 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 17 OCT 18:46Z
    phpMyFAQ 4.2.0-alpha before 4.2.0-beta Unauthenticated DoS via API Pagination
    cvelistv5
  • 17 OCT 18:46Z
    phpMyFAQ 4.2.0-alpha before 4.2.0-beta Unauthenticated DoS via API Pagination
    cvelistv5