CVE-2026-128024
Deferred Deferred - Pending Action

FrankenPHP Denial of Service via Null Integer-Keyed Arrays

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
FrankenPHP before 1.13.0 contains a denial of service vulnerability in goArray() that allows remote attackers to abort the server process via arrays with null integer-keyed elements. Attackers can send crafted JSON passed to frankenphp_log() or returned from worker callbacks, triggering an unrecovered cgo panic that terminates every vhost and in-flight request.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-128024
EUVD
EUVD-2026-125078

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
frankenphp frankenphp to 1.13.0 (exc)
php frankenphp to 1.13.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-248 An exception is thrown from a function, but it is not caught.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

FrankenPHP before version 1.13.0 has a denial of service vulnerability in the goArray() function. Attackers can send crafted JSON data containing arrays with null integer-keyed elements to trigger an unrecovered cgo panic. This causes the entire server process to abort, terminating all virtual hosts and in-flight requests.

Detection Guidance

To detect this vulnerability, monitor for server crashes or process terminations when handling JSON arrays with null integer-keyed elements. Check FrankenPHP logs for cgo panic errors or exit status 2. Use network traffic analysis to identify crafted JSON payloads sent to frankenphp_log() or worker callbacks.

Impact Analysis

This vulnerability allows remote attackers to crash the entire FrankenPHP server without authentication. It causes complete loss of availability for all virtual hosts and ongoing requests. In worker mode, it also results in loss of application state stored in memory. The attack can be repeated indefinitely, leading to sustained outages.

Mitigation Strategies

Upgrade FrankenPHP to version 1.13.0 or later immediately. If upgrading is not possible, restrict access to frankenphp_log() and worker callbacks, and filter incoming JSON data to block arrays with null integer-keyed elements. Monitor server stability closely.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-128024. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...