---
id: CVE-2026-111901
title: phpMyFAQ 4.2.0-alpha before 4.2.0-beta Unauthenticated DoS via API Pagination
summary: >-
  phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an uncontrolled resource
  consumption vulnerability in the unauthenticated faqs and search API
  endpoints. Attackers can send concurrent GET requests that load and process
  all database record…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-400
vendor: thorsten
product: phpMyFAQ
affected:
  - phpMyFAQ >= 4.2.0-alpha < 4.2.0-beta
published: '2026-10-17'
updated: '2026-10-17'
sourceUpdated: '2026-10-17T18:46:22.075Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-111901'
references:
  - url: >-
      https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-m42f-6p37-2c79
    label: GitHub Security Advisory (GHSA-m42f-6p37-2c79)
  - url: >-
      https://www.vulncheck.com/advisories/phpmyfaq-4.2.0-alpha-before-4.2.0-beta-unauthenticated-dos-via-api-pagination
    label: >-
      VulnCheck Advisory: phpMyFAQ 4.2.0-alpha before 4.2.0-beta Unauthenticated
      DoS via API Pagination
tags:
  - cve.org
ingestedAt: '2026-10-17T19:08:56.895Z'
---

## Overview

phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an uncontrolled resource consumption vulnerability in the unauthenticated faqs and search API endpoints. Attackers can send concurrent GET requests that load and process all database records into PHP memory, exhausting CPU and memory to crash the server.

## Affected

- `phpMyFAQ >= 4.2.0-alpha < 4.2.0-beta`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.