CVE-2026-111901 is a high severity (CVSS 7.5) denial of service in phpMyFAQ 4.2.0-alpha before 4.2.0-beta. Unauthenticated calls to the faqs and search API load every record into PHP memory and can crash the server. Upgrade to 4.2.0-beta. The sections below cover affected versions, how to check, and what to do first.
What's affected
phpMyFAQ 4.2.0-alpha before 4.2.0-beta, per the record. The GitHub advisory lists the patched version as 4.2.0-beta, and the sources agree.
The affected routes are the REST endpoints that list FAQs and search them. The advisory says they paginate in application code rather than in the database. The impact scales with the number of FAQs in the database, so large knowledge bases are hit first.
Scoring note: the record's 7.5 is a CVSS 3.1 base score. VulnCheck's advisory also lists 8.7 under CVSS 4.0. Both describe the same flaw, and the two versions weigh the factors differently.
How to check if you're exposed
Check your version:
composer show phpmyfaq/phpmyfaq
If you run a 4.2 alpha, you are affected. Watch memory and CPU on the web host, and look in access logs for bursts of requests to the faqs and search API paths from a single source.
What to do now
- Find your phpMyFAQ version.
- Upgrade to 4.2.0-beta or later.
- Rate limit the API at the proxy while you upgrade.
- Set a memory limit and process restarts so one overload does not stay down.
- Consider requiring a token for the API if you do not need anonymous access.
- Scan your dependencies with the free in-browser scan and look the CVE up in the Gold directory to see where else it appears.
Prioritise by what is reachable, not by the score alone. Reachability analysis asks whether your own code actually calls the vulnerable path and whether an attacker can get to it. A flaw in a component you never expose is less urgent than the same flaw on a public host, so use that view to order your work.
Why it matters
This is CWE-400, uncontrolled resource consumption. Pagination exists to bound work per request. Here the server fetches all matching rows, does string work on each and sorts them in memory before it cuts out one page. The cost of every request grows with the whole dataset, not with the page size.
That makes small requests expensive, which is the shape of an easy denial of service. Push limits and sorting to the database. The record rates impact on confidentiality and integrity as none. It is not listed in CISA KEV.
Quick check
Does this leak data?
No. The record rates only availability impact.
What is a quick stopgap?
Rate limit the two API paths at your proxy or require authentication for them.
Sources
Last reviewed: 18 October 2026.
