{"id":"CVE-2026-128015","kind":"vulnerability","aliases":["CVE-2026-128015"],"related":[],"title":"FrankenPHP: putenv during shutdown lets requests crash the process or leak data","description":"FrankenPHP before 1.13.4 contains a use-after-free vulnerability that leaves a dangling pointer to a freed environment table when putenv() is called during request shutdown. Attackers triggering putenv() in shutdown functions, destructors, or session handlers can crash the process on the next getenv() call or leak previous request environment values.","summary":"FrankenPHP before 1.13.4 frees an environment table during request shutdown but keeps a pointer to it, so a later putenv() or getenv() call can use freed memory. An attacker who can trigger putenv() in shutdown functions, destructors or session handlers can crash the process or read environment values left over from a previous request.","severity":"high","cvss":8.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["frankenphp","kubernetes","php","runtime","self-hosted"],"not_affected_if":["fixed-version","no-putenv-in-shutdown"],"how_to_check":"- Check the FrankenPHP version with `frankenphp version` or the binary used in the container image.\n- Look for FrankenPHP in the deployed image or go.mod (`github.com/dunglas/frankenphp`) and confirm whether the version is below `1.13.4`.","fix":"- FrankenPHP: move to `1.13.4` or later.","status":"open","published_at":"2026-11-13T10:18:06+00:00","first_seen_at":"2026-11-13T10:47:30+00:00","triaged_at":"2026-11-13T10:51:06+00:00","updated_at":"2026-11-13T10:51:06+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-13T10:51:06Z","model":"claude-haiku-5-5","output":{"fix":"- FrankenPHP: move to `1.13.4` or later.","reach":"internet","title":"FrankenPHP: putenv during shutdown lets requests crash the process or leak data","impact":"medium","summary":"FrankenPHP before 1.13.4 frees an environment table during request shutdown but keeps a pointer to it, so a later putenv() or getenv() call can use freed memory. An attacker who can trigger putenv() in shutdown functions, destructors or session handlers can crash the process or read environment values left over from a previous request.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["frankenphp","php","self-hosted","kubernetes"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"process crashes or previous request environment values leak","analyst_note":"","how_to_check":"- Check the FrankenPHP version with `frankenphp version` or the binary used in the container image.\n- Look for FrankenPHP in the deployed image or go.mod (`github.com/dunglas/frankenphp`) and confirm whether the version is below `1.13.4`.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["fixed-version","no-putenv-in-shutdown"],"who_is_affected":"Applications running FrankenPHP below 1.13.4 that call putenv() during request shutdown, in shutdown functions, destructors or session handlers, are exposed. Teams running other PHP servers or FrankenPHP at 1.13.4 or later can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000747,"input_tokens":4622,"output_tokens":569,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-128015':15A,18A '-2026':14A,17A '1.13.4':28B,82C 'attack':54B,107C 'call':48B,103C,125C 'contain':83C 'crash':7A,67B,118C 'cve':13A,16A 'dangl':93C 'data':12A 'destructor':62B,113C 'environ':31B,72B,98C,130C 'frankenphp':1A,19B,26B,80C 'free':29B,88C 'freed':51B,97C 'function':61B,112C 'getenv':47B,124C 'handler':65B,116C 'host':25B 'keep':37B 'kubernet':20B 'later':44B 'leak':11A,127C 'leav':91C 'left':74B 'let':5A 'memori':52B 'next':123C 'php':21B 'pointer':39B,94C 'previous':78B,128C 'process':9A,69B,120C 'putenv':2A,45B,58B,101C,109C 'read':71B 'request':6A,34B,79B,105C,129C 'runtim':22B 'self':24B 'self-host':23B 'session':64B,115C 'shutdown':4A,35B,60B,106C,111C 'tabl':32B,99C 'trigger':57B,108C 'use':50B,86C 'use-after-fre':85C 'valu':73B,131C 'vulner':89C","nicknames":[],"mitigations":[],"who_affected":"Applications running FrankenPHP below 1.13.4 that call putenv() during request shutdown, in shutdown functions, destructors or session handlers, are exposed. Teams running other PHP servers or FrankenPHP at 1.13.4 or later can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["frankenphp","high","kubernetes","php","runtime","selfhosted"],"campaign_type":null,"search_a":"'-128015':15A,18A '-2026':14A,17A 'crash':7A 'cve':13A,16A 'data':12A 'frankenphp':1A 'leak':11A 'let':5A 'process':9A 'putenv':2A 'request':6A 'shutdown':4A","search_b":"'1.13.4':28B 'attack':54B 'call':48B 'crash':67B 'destructor':62B 'environ':31B,72B 'frankenphp':19B,26B 'free':29B 'freed':51B 'function':61B 'getenv':47B 'handler':65B 'host':25B 'keep':37B 'kubernet':20B 'later':44B 'left':74B 'memori':52B 'php':21B 'pointer':39B 'previous':78B 'process':69B 'putenv':45B,58B 'read':71B 'request':34B,79B 'runtim':22B 'self':24B 'self-host':23B 'session':64B 'shutdown':35B,60B 'tabl':32B 'trigger':57B 'use':50B 'valu':73B","search_c":"'1.13.4':82C 'attack':107C 'call':103C,125C 'contain':83C 'crash':118C 'dangl':93C 'destructor':113C 'environ':98C,130C 'frankenphp':80C 'free':88C 'freed':97C 'function':112C 'getenv':124C 'handler':116C 'leak':127C 'leav':91C 'next':123C 'pointer':94C 'previous':128C 'process':120C 'putenv':101C,109C 'request':105C,129C 'session':115C 'shutdown':106C,111C 'tabl':99C 'trigger':108C 'use':86C 'use-after-fre':85C 'valu':131C 'vulner':89C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-26T16:53:39+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-128015","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128015","severity":null,"published_at":"2026-11-13T10:18:06+00:00","modified_at":"2026-11-13T10:18:06+00:00","first_seen_at":"2026-11-13T10:47:30+00:00","fetched_at":"2026-11-13T10:47:30+00:00","note":null}],"documents":[{"id":145325,"url":"https://github.com/php/frankenphp/commit/ab174aa6c27738b9ee56c97ac276d152bfb38f5e","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":145326,"url":"https://github.com/php/frankenphp/security/advisories/GHSA-rgpj-f2qx-xwhf","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-26T16:53:39+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145327,"url":"https://www.vulncheck.com/advisories/frankenphp-before-1.13.4-use-after-free-via-putenv-during-request-shutdown","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}