CVE-2026-128022
Deferred Deferred - Pending Action

FrankenPHP Resource Exhaustion via Uncancelled Queued Requests

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
FrankenPHP before 1.13.2 contains a resource exhaustion vulnerability that allows unauthenticated clients to tie up PHP threads because queued requests are not cancelled when clients disconnect. Attackers can send many requests and close connections immediately, forcing handleRequestWithRegularPHPThreads and worker handlers to execute them and delay all clients sharing the thread pool.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-128022
EUVD
EUVD-2026-125080

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
frankenphp frankenphp to 1.13.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

FrankenPHP before version 1.13.2 has a resource exhaustion flaw where unauthenticated clients can occupy PHP threads by sending requests and disconnecting immediately. This causes queued requests to remain uncancelled, forcing the server to process them and delaying other clients sharing the same thread pool.

Detection Guidance

Detecting this vulnerability requires monitoring for unusual request patterns where clients disconnect immediately after sending requests, causing thread pool exhaustion. Check server logs for high volumes of incomplete or abruptly terminated requests. Use tools like netstat or ss to observe many half-open connections. Monitor PHP thread pools for sustained high utilization without corresponding completed requests.

Impact Analysis

This vulnerability can degrade server performance by consuming all available PHP threads, leading to slow response times or denial of service for legitimate users. Systems relying on FrankenPHP may experience degraded functionality or crashes under sustained attack.

Mitigation Strategies

Upgrade FrankenPHP to version 1.13.2 or later to address the resource exhaustion issue. Implement rate limiting to prevent abuse of the thread pool. Configure timeouts for incoming connections to terminate idle or abandoned requests promptly. Monitor thread pool usage and set alerts for abnormal spikes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-128022. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...