Denial of Service Vulnerability in FrankenPHP by PHP
CVE-2026-128018

6.3MEDIUM

Key Information:

Vendor

PHP
Status
FrankenPHP
Vendor
CVE Published:
13 November 2026

What is CVE-2026-128018?

FrankenPHP versions prior to 1.13.4 are susceptible to a denial of service issue in worker mode. A flaw in the frankenphp_handle_request() function allows it to return false without completing dequeued requests when a fatal error occurs during request startup. This vulnerability can be exploited by attackers to trigger fatal errors in worker scripts, resulting in an indefinite hang of client requests, while the worker process continues to run. This can severely impact server performance and degrade user experience.

Affected Version(s)

frankenphp 0 < 1.13.4

frankenphp 1.13.4

References

https://github.com/php/frankenphp/security/advisories/GHS...
vendor-advisory
https://github.com/php/frankenphp/commit/185bfe578af854d2...
patch
https://www.vulncheck.com/advisories/frankenphp-before-1....
third-party-advisory

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

inanna-malick
.