CVE-2014-125127 Denial of Service (DoS) vulnerability in mikecao/flight
Attackers can cause denial of service by sending large payloads that exhaust server memory due to eager loading of request bodies in the Flight PHP framework.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2014-125127?
CVE-2014-125127 is a high-severity denial of service vulnerability in flightphp core, published on 3 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The mikecao/flight PHP framework in versions prior to v1.2 is vulnerable to Denial of Service (DoS) attacks due to eager loading of request bodies in the Request class constructor. The framework automatically reads the entire request body on every HTTP request, regardless of whether the application needs it. An attacker can exploit this by sending requests with large payloads, causing excessive memory consumption and potentially exhausting available server memory, leading to application crashes or service unavailability. The vulnerability was fixed in v1.2 by implementing lazy loading of request bodies.
Weakness: CWE-770
Which versions are affected by CVE-2014-125127?
It affects 1 product.
Products include Flightphp Flight.
How do I fix CVE-2014-125127?
No fix has been published for CVE-2014-125127 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2014-125127 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2014-125127 exists.
Sources
Also known as GHSA-q996-685m-c683.