CVE-2014-125127

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2014-125127
The mikecao/flight PHP framework in versions prior to v1.2 is vulnerable to Denial of Service (DoS) attacks due to eager loading of request bodies in the Request class constructor. The framework automatically reads the entire request body on every HTTP request, regardless of whether the application needs it. An attacker can exploit this by sending requests with large payloads, causing excessive memory consumption and potentially exhausting available server memory, leading to application crashes or service unavailability. The vulnerability was fixed in v1.2 by implementing lazy loading of request bodies.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/Checkmarx/Vulnerabilities-Proofs-of-Concept/tree/main/2014/CVE-2014-125127 Exploit Third Party Advisory
https://github.com/mikecao/flight/commit/da40e03eb4a39745107912dffe926a8fce0d38dc Patch
https://github.com/mikecao/flight/pull/125 Issue Tracking
https://github.com/Checkmarx/Vulnerabilities-Proofs-of-Concept/tree/main/2014/CVE-2014-125127 Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:flightphp:flight:*:*:*:*:*:php:*:*
History

18 Dec 2025, 17:47

Type Values Removed Values Added
First Time Flightphp flight
Flightphp
CPE cpe:2.3:a:flightphp:flight:*:*:*:*:*:php:*:*
References () https://github.com/Checkmarx/Vulnerabilities-Proofs-of-Concept/tree/main/2014/CVE-2014-125127 - () https://github.com/Checkmarx/Vulnerabilities-Proofs-of-Concept/tree/main/2014/CVE-2014-125127 - Exploit, Third Party Advisory
References () https://github.com/mikecao/flight/commit/da40e03eb4a39745107912dffe926a8fce0d38dc - () https://github.com/mikecao/flight/commit/da40e03eb4a39745107912dffe926a8fce0d38dc - Patch
References () https://github.com/mikecao/flight/pull/125 - () https://github.com/mikecao/flight/pull/125 - Issue Tracking

03 Sep 2025, 14:15

Type Values Removed Values Added
References () https://github.com/Checkmarx/Vulnerabilities-Proofs-of-Concept/tree/main/2014/CVE-2014-125127 - () https://github.com/Checkmarx/Vulnerabilities-Proofs-of-Concept/tree/main/2014/CVE-2014-125127 -

03 Sep 2025, 09:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-09-03 09:15

Updated : 2025-12-18 17:47

NVD link : CVE-2014-125127

Mitre link : CVE-2014-125127

CVE.ORG link : CVE-2014-125127

JSON object : View

Products Affected

flightphp

  • flight
CWE
CWE-770

Allocation of Resources Without Limits or Throttling