Denial of Service Vulnerability in FrankenPHP by PHP
CVE-2026-128024

8.2HIGH

Key Information:

Vendor

PHP
Status
FrankenPHP
Vendor
CVE Published:
13 November 2026

What is CVE-2026-128024?

FrankenPHP versions prior to 1.13.0 are susceptible to a denial of service vulnerability. This issue arises in the goArray() function, where remote attackers can exploit arrays containing null integer-keyed elements. By crafting JSON payloads sent to frankenphp_log() or through returned worker callbacks, attackers can trigger a cgo panic that leads to the abrupt termination of the server process. This vulnerability can disrupt all virtual hosts and affect ongoing requests, posing a significant risk to server uptime and availability.

Affected Version(s)

frankenphp 0 < 1.13.0

frankenphp 1.13.0

References

https://github.com/php/frankenphp/security/advisories/GHS...
vendor-advisory
https://www.vulncheck.com/advisories/frankenphp-before-1....
third-party-advisory

CVSS V4

Score:
8.2
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

bipol4r
.