PT-2025-35706 · Mikecao · Mikecao/Flight

Published 2025-09-03 · Updated 2025-09-03 · CVE-2014-125127

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions mikecao/flight versions prior to v1.2

Description The mikecao/flight PHP framework is susceptible to Denial of Service (DoS) attacks. This is due to the eager loading of request bodies within the Request class constructor. The framework automatically reads the entire request body for every HTTP request, irrespective of application requirements. An attacker can exploit this by sending requests with large payloads, potentially leading to excessive memory consumption, application crashes, or service unavailability. The issue was addressed in version v1.2 by implementing lazy loading of request bodies.

Recommendations Upgrade to version 1.2 or later to resolve this issue.

Exploit

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2014-125127

Affected Products

Mikecao/Flight

References · 6

• 🔥 https://github.com/Checkmarx/Vulnerabilities-Proofs-of-Concept/tree/main/2014/CVE-2014-125127 · Exploit
• https://github.com/mikecao/flight/commit/da40e03eb4a39745107912dffe926a8fce0d38dc · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2014-125127 · Security Note
• https://github.com/mikecao/flight/pull/125 · Note
• https://t.me/CVEtracker/31579 · Telegram Post
• https://t.me/cveNotify/134172 · Telegram Post