# CVE-2026-111901: phpMyFAQ uncontrolled resource consumption in API pagination

Source: https://junglewise.ai/threats/cve-2026-111901-phpmyfaq-4-2-0-alpha-before-4-2-0-beta-contains-an-uncontrolled  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-17. Updated: 2026-10-17  
License: CC BY 4.0 with a link back

CVE-2026-111901 · Severity: high · CVSS 7.5 · Published 2026-10-17

phpMyFAQ is a frequently asked questions knowledge base system used to provide self-service support to users. An unauthenticated attacker can send repeated requests to the FAQ and search API endpoints, forcing the server to load entire database contents into memory, exhausting CPU and RAM until the application crashes and denies service to all users.

Technologies: [Phpmyfaq](https://junglewise.ai/threats/technologies/phpmyfaq-phpmyfaq-1). Vendors: [Phpmyfaq](https://junglewise.ai/threats/vendors/phpmyfaq).

## Quick answers

**Is CVE-2026-111901 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-111901 being exploited in the wild.

**How severe is CVE-2026-111901?** High severity, with a CVSS score of 7.5, published 17 October 2026.

**Which products and versions are affected?** Phpmyfaq 4.2.0-alpha before 4.2.0-beta.

**Is there a fix for CVE-2026-111901?** Yes: fixed in 4.2.0-beta. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-111901 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-111901?** Check whether you run Phpmyfaq at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 4.2.0-beta

## Technical details

The REST API endpoints GET /api/v4.0/faqs and GET /api/v4.0/search implement pagination at the application level rather than the database level, fetching all matching records into PHP memory before processing and slicing. An unauthenticated attacker can send concurrent requests to exhaust resources (CWE-400). Affected versions prior to 4.2.0-beta lack database-level LIMIT/OFFSET pagination, making each request expensive as the application strips HTML tags, sorts results, and then discards most of the data.

## Affected products

- phpMyFAQ phpMyFAQ 4.2.0-alpha before 4.2.0-beta

## Timeline

- 2026-10-03: advisory
- 2026-10-17: disclosed

## References

- [https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-m42f-6p37-2c79](https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-m42f-6p37-2c79)
- [https://www.vulncheck.com/advisories/phpmyfaq-4.2.0-alpha-before-4.2.0-beta-unauthenticated-dos-via-api-pagination](https://www.vulncheck.com/advisories/phpmyfaq-4.2.0-alpha-before-4.2.0-beta-unauthenticated-dos-via-api-pagination)

## Related threats

- [phpMyFAQ insecure direct object reference in admin user API](https://junglewise.ai/threats/cve-2026-111905-phpmyfaq-3-2-0-before-4-1-9-and-4-2-0-alpha-before-4-2-0-beta)
- [phpMyFAQ improper authorization in attachment.php](https://junglewise.ai/threats/cve-2026-111900-phpmyfaq-before-4-1-9-and-4-2-0-alpha-before-4-2-0-beta-contains)
- [phpMyFAQ authentication bypass in Microsoft Entra ID login](https://junglewise.ai/threats/cve-2026-111895-phpmyfaq-3-2-0-before-4-0-0-and-4-0-2-before-4-2-0-beta-contains)
- [phpMyFAQ versions 3.1.0 through 4.1.6 contain an authentication bypass vulnerability in AuthLdap::create(). When LDAP…](https://junglewise.ai/threats/cve-2026-76208-phpmyfaq-versions-3-1-0-through-4-1-6-contain-an-authentication)
- [phpMyFAQ: Stored XSS via Regex Bypass in Filter::removeAttributes()](https://junglewise.ai/threats/cve-2026-34729-phpmyfaq-stored-xss-via-regex-bypass-in-filter-removeattributes)