{"id":"CVE-2026-128017","kind":"vulnerability","aliases":["CVE-2026-128017"],"related":[],"title":"FrankenPHP: double free in worker mode lets unauthenticated requests crash the process","description":"FrankenPHP before 1.13.4 contains a double free vulnerability in worker mode that frees SG(request_info).content_type_dup twice when a worker script ends its loop after a non-form POST request. Unauthenticated attackers can send repeated JSON POST requests until the worker loop ends, aborting the whole process when USE_ZEND_ALLOC=0 is set.","summary":"FrankenPHP before 1.13.4 frees the same request content-type buffer twice in worker mode after a non-form POST request ends a worker loop. An unauthenticated attacker can send repeated JSON POST requests to abort the whole process when USE_ZEND_ALLOC=0 is set.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"FrankenPHP","fixed":[],"affected":"","ecosystem":"runtime"}],"ecosystems":["runtime"],"tags":["frankenphp","php","runtime","self-hosted","worker-mode"],"not_affected_if":["default-config","no-worker-mode"],"how_to_check":"- Check the FrankenPHP version with `frankenphp version` and compare it against `1.13.4`.\n- Check whether worker mode is in use and whether `USE_ZEND_ALLOC=0` is set in the environment.","fix":"- FrankenPHP: move to `1.13.4` or later.","status":"open","published_at":"2026-11-13T10:18:06+00:00","first_seen_at":"2026-11-13T10:47:30+00:00","triaged_at":"2026-11-13T10:55:16+00:00","updated_at":"2026-11-13T10:55:16+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-13T10:55:16Z","model":"claude-haiku-5-5","output":{"fix":"- FrankenPHP: move to `1.13.4` or later.","reach":"internet","title":"FrankenPHP: double free in worker mode lets unauthenticated requests crash the process","impact":"medium","summary":"FrankenPHP before 1.13.4 frees the same request content-type buffer twice in worker mode after a non-form POST request ends a worker loop. An unauthenticated attacker can send repeated JSON POST requests to abort the whole process when USE_ZEND_ALLOC=0 is set.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["frankenphp","php","worker-mode","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"unauthenticated requests crash the whole FrankenPHP process","analyst_note":"Confirm the affected version range and whether the fix at 1.13.4 is in the Patch linked from github.com; the data gives no product ranges.","how_to_check":"- Check the FrankenPHP version with `frankenphp version` and compare it against `1.13.4`.\n- Check whether worker mode is in use and whether `USE_ZEND_ALLOC=0` is set in the environment.","plain_action":"","product_name":"FrankenPHP","needs_analyst":true,"not_affected_if":["default-config","no-worker-mode"],"who_is_affected":"Servers running FrankenPHP before 1.13.4 in worker mode that accept JSON POST requests from the internet are exposed. The crash path needs USE_ZEND_ALLOC=0 to be set, so deployments with the default allocator are less exposed. Sites not running FrankenPHP workers can skip it.","user_interaction":"no","product_ecosystem":"runtime","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.00078,"input_tokens":4627,"output_tokens":634,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-128017':15A,18A '-2026':14A,17A '0':73B,131C '1.13.4':31B,78C 'abort':65B,123C 'alloc':72B,130C 'attack':57B,111C 'buffer':39B 'contain':79C 'content':37B,92C 'content-typ':36B 'crash':10A 'cve':13A,16A 'doubl':2A,81C 'dup':94C 'end':51B,100C,122C 'form':48B,107C 'frankenphp':1A,19A,20B,29B,76C 'free':3A,32B,82C,88C 'host':25B 'info':91C 'json':61B,115C 'let':7A 'loop':54B,102C,121C 'mode':6A,28B,43B,86C 'non':47B,106C 'non-form':46B,105C 'php':21B 'post':49B,62B,108C,116C 'process':12A,68B,126C 'repeat':60B,114C 'request':9A,35B,50B,63B,90C,109C,117C 'runtim':22B 'script':99C 'self':24B 'self-host':23B 'send':59B,113C 'set':75B,133C 'sg':89C 'twice':40B,95C 'type':38B,93C 'unauthent':8A,56B,110C 'use':70B,128C 'vulner':83C 'whole':67B,125C 'worker':5A,27B,42B,53B,85C,98C,120C 'worker-mod':26B 'zend':71B,129C","nicknames":[],"mitigations":[],"who_affected":"Servers running FrankenPHP before 1.13.4 in worker mode that accept JSON POST requests from the internet are exposed. The crash path needs USE_ZEND_ALLOC=0 to be set, so deployments with the default allocator are less exposed. Sites not running FrankenPHP workers can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["frankenphp"],"ptokens":["frankenphp"],"labels":["frankenphp","medium","php","runtime","selfhosted","workermode"],"campaign_type":null,"search_a":"'-128017':15A,18A '-2026':14A,17A 'crash':10A 'cve':13A,16A 'doubl':2A 'frankenphp':1A,19A 'free':3A 'let':7A 'mode':6A 'process':12A 'request':9A 'unauthent':8A 'worker':5A","search_b":"'0':73B '1.13.4':31B 'abort':65B 'alloc':72B 'attack':57B 'buffer':39B 'content':37B 'content-typ':36B 'end':51B 'form':48B 'frankenphp':20B,29B 'free':32B 'host':25B 'json':61B 'loop':54B 'mode':28B,43B 'non':47B 'non-form':46B 'php':21B 'post':49B,62B 'process':68B 'repeat':60B 'request':35B,50B,63B 'runtim':22B 'self':24B 'self-host':23B 'send':59B 'set':75B 'twice':40B 'type':38B 'unauthent':56B 'use':70B 'whole':67B 'worker':27B,42B,53B 'worker-mod':26B 'zend':71B","search_c":"'0':131C '1.13.4':78C 'abort':123C 'alloc':130C 'attack':111C 'contain':79C 'content':92C 'doubl':81C 'dup':94C 'end':100C,122C 'form':107C 'frankenphp':76C 'free':82C,88C 'info':91C 'json':115C 'loop':102C,121C 'mode':86C 'non':106C 'non-form':105C 'post':108C,116C 'process':126C 'repeat':114C 'request':90C,109C,117C 'script':99C 'send':113C 'set':133C 'sg':89C 'twice':95C 'type':93C 'unauthent':110C 'use':128C 'vulner':83C 'whole':125C 'worker':85C,98C,120C 'zend':129C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-26T16:53:46+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-128017","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128017","severity":null,"published_at":"2026-11-13T10:18:06+00:00","modified_at":"2026-11-13T10:18:07+00:00","first_seen_at":"2026-11-13T10:47:30+00:00","fetched_at":"2026-11-13T10:47:30+00:00","note":null}],"documents":[{"id":145331,"url":"https://github.com/php/frankenphp/commit/8777cc2e5c872ebb869fa2b5f972a913648621e8","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":145332,"url":"https://github.com/php/frankenphp/security/advisories/GHSA-h764-4wh7-m7j2","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-26T16:53:46+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145333,"url":"https://www.vulncheck.com/advisories/frankenphp-before-1.13.4-double-free-in-worker-mode-via-non-form-post","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}