{"id":"CVE-2026-128022","kind":"vulnerability","aliases":["CVE-2026-128022"],"related":[],"title":"FrankenPHP: queued requests keep running after disconnect, exhausting PHP threads","description":"FrankenPHP before 1.13.2 contains a resource exhaustion vulnerability that allows unauthenticated clients to tie up PHP threads because queued requests are not cancelled when clients disconnect. Attackers can send many requests and close connections immediately, forcing handleRequestWithRegularPHPThreads and worker handlers to execute them and delay all clients sharing the thread pool.","summary":"FrankenPHP before 1.13.2 keeps executing queued requests after the client has disconnected. An unauthenticated attacker can send many requests and close connections at once, tying up the shared PHP thread pool and delaying other clients.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["frankenphp","php","runtime","self-hosted"],"not_affected_if":["fixed-version","internal-only"],"how_to_check":"- Check the FrankenPHP version with `frankenphp version` or the version in your build or container image.\n- Look for the FrankenPHP binary or image used to serve PHP traffic on internet-facing hosts.","fix":"- FrankenPHP: upgrade to `1.13.2` or later.","status":"open","published_at":"2026-11-13T10:18:07+00:00","first_seen_at":"2026-11-13T10:47:31+00:00","triaged_at":"2026-11-13T10:54:38+00:00","updated_at":"2026-11-13T10:54:38+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-13T10:54:38Z","model":"claude-haiku-5-5","output":{"fix":"- FrankenPHP: upgrade to `1.13.2` or later.","reach":"internet","title":"FrankenPHP: queued requests keep running after disconnect, exhausting PHP threads","impact":"low","summary":"FrankenPHP before 1.13.2 keeps executing queued requests after the client has disconnected. An unauthenticated attacker can send many requests and close connections at once, tying up the shared PHP thread pool and delaying other clients.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["frankenphp","php","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Shared PHP thread pool stalls, delaying all clients on the server","analyst_note":"","how_to_check":"- Check the FrankenPHP version with `frankenphp version` or the version in your build or container image.\n- Look for the FrankenPHP binary or image used to serve PHP traffic on internet-facing hosts.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["fixed-version","internal-only"],"who_is_affected":"Any service that exposes a FrankenPHP server to clients, especially to the internet, is in scope. Low-traffic internal tools with trusted clients are less exposed. unknown whether the sources list specific configurations beyond this.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000714,"input_tokens":4631,"output_tokens":502,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-128022':13A,16A '-2026':12A,15A '1.13.2':25B,60C 'allow':67C 'attack':37B,84C 'cancel':80C 'client':32B,57B,69C,82C,104C 'close':43B,90C 'connect':44B,91C 'contain':61C 'cve':11A,14A 'delay':55B,102C 'disconnect':7A,34B,83C 'execut':27B,99C 'exhaust':8A,64C 'forc':93C 'frankenphp':1A,17B,23B,58C 'handler':97C 'handlerequestwithregularphpthread':94C 'host':22B 'immedi':92C 'keep':4A,26B 'mani':40B,87C 'php':9A,18B,51B,73C 'pool':53B,108C 'queu':2A,28B,76C 'request':3A,29B,41B,77C,88C 'resourc':63C 'run':5A 'runtim':19B 'self':21B 'self-host':20B 'send':39B,86C 'share':50B,105C 'thread':10A,52B,74C,107C 'tie':47B,71C 'unauthent':36B,68C 'vulner':65C 'worker':96C","nicknames":[],"mitigations":[],"who_affected":"Any service that exposes a FrankenPHP server to clients, especially to the internet, is in scope. Low-traffic internal tools with trusted clients are less exposed. unknown whether the sources list specific configurations beyond this.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["frankenphp","medium","php","runtime","selfhosted"],"campaign_type":null,"search_a":"'-128022':13A,16A '-2026':12A,15A 'cve':11A,14A 'disconnect':7A 'exhaust':8A 'frankenphp':1A 'keep':4A 'php':9A 'queu':2A 'request':3A 'run':5A 'thread':10A","search_b":"'1.13.2':25B 'attack':37B 'client':32B,57B 'close':43B 'connect':44B 'delay':55B 'disconnect':34B 'execut':27B 'frankenphp':17B,23B 'host':22B 'keep':26B 'mani':40B 'php':18B,51B 'pool':53B 'queu':28B 'request':29B,41B 'runtim':19B 'self':21B 'self-host':20B 'send':39B 'share':50B 'thread':52B 'tie':47B 'unauthent':36B","search_c":"'1.13.2':60C 'allow':67C 'attack':84C 'cancel':80C 'client':69C,82C,104C 'close':90C 'connect':91C 'contain':61C 'delay':102C 'disconnect':83C 'execut':99C 'exhaust':64C 'forc':93C 'frankenphp':58C 'handler':97C 'handlerequestwithregularphpthread':94C 'immedi':92C 'mani':87C 'php':73C 'pool':108C 'queu':76C 'request':77C,88C 'resourc':63C 'send':86C 'share':105C 'thread':74C,107C 'tie':71C 'unauthent':68C 'vulner':65C 'worker':96C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-21T18:27:32+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-128022","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128022","severity":null,"published_at":"2026-11-13T10:18:07+00:00","modified_at":"2026-11-13T10:18:07+00:00","first_seen_at":"2026-11-13T10:47:31+00:00","fetched_at":"2026-11-13T10:47:31+00:00","note":null}],"documents":[{"id":145344,"url":"https://github.com/php/frankenphp/security/advisories/GHSA-fq24-r53r-xcx3","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-21T18:27:32+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145345,"url":"https://www.vulncheck.com/advisories/frankenphp-before-1.13.2-denial-of-service-via-queued-disconnected-requests","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}