An uncontrolled resource consumption weakness allows unauthenticated attackers to trigger a crash of the PHP process by sending concurrent GET requests to the faqs and search API endpoints, causing the application to load and process all database rows into memory. This results in a denial‑of‑service condition, compromising availability of the web service.

The issue affects all installations of phpMyFAQ version 4.2.0‑alpha through versions just prior to 4.2.0‑beta, as released by the vendor thorsten. Any environment running these pre‑beta releases is vulnerable unless upgraded.

The CVSS score of 8.7 marks it as a high‑impact vulnerability. Exploitation requires no credentials and is driven by network access; an attacker can simply issue repeated HTTP GET requests to the exposed endpoints. The vulnerability is not listed in CISA's KEV catalog, and no EPSS data is available, but the straightforward attack path and lack of authentication suggest a high likelihood of abuse in a motivated threat scenario. No threat of remote code execution occurs; the impact is limited to service disruption.