---
id: "CVE-2026-128022"
page: "https://infrastack.ai/live/CVE-2026-128022"
kind: "vulnerability"
aliases: ["CVE-2026-128022"]
title: "FrankenPHP: queued requests keep running after disconnect, exhausting PHP threads"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["frankenphp", "php", "runtime", "self-hosted"]
not_affected_if: ["fixed-version", "internal-only"]
published_at: "2026-11-13T10:18:07+00:00"
first_seen_at: "2026-11-13T10:47:31+00:00"
updated_at: "2026-11-13T10:54:38+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-128022", "first_seen_at": "2026-11-13T10:47:31+00:00"}]
exploit_sources: []
---

# FrankenPHP: queued requests keep running after disconnect, exhausting PHP threads

Link for people: https://infrastack.ai/live/CVE-2026-128022 (this .md is for agents)

FrankenPHP before 1.13.2 keeps executing queued requests after the client has disconnected. An unauthenticated attacker can send many requests and close connections at once, tying up the shared PHP thread pool and delaying other clients.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the FrankenPHP version with `frankenphp version` or the version in your build or container image.
- Look for the FrankenPHP binary or image used to serve PHP traffic on internet-facing hosts.

## Fix

- FrankenPHP: upgrade to `1.13.2` or later.

## Timeline

- 2026-11-13T10:47:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-128022

## Documents

- [advisory] Vendor advisory: github.com https://github.com/php/frankenphp/security/advisories/GHSA-fq24-r53r-xcx3
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/frankenphp-before-1.13.2-denial-of-service-via-queued-disconnected-requests

## From the sources

FrankenPHP before 1.13.2 contains a resource exhaustion vulnerability that allows unauthenticated clients to tie up PHP threads because queued requests are not cancelled when clients disconnect. Attackers can send many requests and close connections immediately, forcing handleRequestWithRegularPHPThreads and worker handlers to execute them and delay all clients sharing the thread pool.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_