{"id":"CVE-2026-128024","kind":"vulnerability","aliases":["CVE-2026-128024"],"related":[],"title":"FrankenPHP: crafted JSON arrays crash the server process and every request","description":"FrankenPHP before 1.13.0 contains a denial of service vulnerability in goArray() that allows remote attackers to abort the server process via arrays with null integer-keyed elements. Attackers can send crafted JSON passed to frankenphp_log() or returned from worker callbacks, triggering an unrecovered cgo panic that terminates every vhost and in-flight request.","summary":"FrankenPHP before 1.13.0 has a denial-of-service flaw in its goArray() conversion, where arrays with null integer-keyed elements cause an unrecovered cgo panic. A remote attacker who sends crafted JSON passed to frankenphp_log() or returned from worker callbacks can abort the whole server process, dropping every vhost and in-flight request.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["frankenphp","kubernetes","php","runtime","self-hosted"],"not_affected_if":["fixed-version","no-worker-mode"],"how_to_check":"- Check the FrankenPHP version with `frankenphp version` or the binary used in your image; versions below `1.13.0` are in range.\n- Look for applications that call `frankenphp_log()` or return arrays from FrankenPHP worker callbacks using decoded JSON from request input.","fix":"- FrankenPHP: upgrade to `1.13.0` or later.","status":"open","published_at":"2026-11-13T10:18:08+00:00","first_seen_at":"2026-11-13T10:47:31+00:00","triaged_at":"2026-11-13T10:51:21+00:00","updated_at":"2026-11-13T10:51:21+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-11-13T10:51:21Z","model":"claude-haiku-5-5","output":{"fix":"- FrankenPHP: upgrade to `1.13.0` or later.","reach":"internet","title":"FrankenPHP: crafted JSON arrays crash the server process and every request","impact":"high","summary":"FrankenPHP before 1.13.0 has a denial-of-service flaw in its goArray() conversion, where arrays with null integer-keyed elements cause an unrecovered cgo panic. A remote attacker who sends crafted JSON passed to frankenphp_log() or returned from worker callbacks can abort the whole server process, dropping every vhost and in-flight request.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["frankenphp","php","self-hosted","kubernetes"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Remote request crashes the server process and all vhosts","analyst_note":"","how_to_check":"- Check the FrankenPHP version with `frankenphp version` or the binary used in your image; versions below `1.13.0` are in range.\n- Look for applications that call `frankenphp_log()` or return arrays from FrankenPHP worker callbacks using decoded JSON from request input.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["fixed-version","no-worker-mode"],"who_is_affected":"FrankenPHP servers below 1.13.0 that pass request-derived JSON into frankenphp_log() or return it from worker callbacks are exposed. Servers that do not use worker mode or that never feed untrusted JSON into those paths are less likely to be reached. The sources do not say whether default configurations are affected in every case.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000764,"input_tokens":4620,"output_tokens":604,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-128024':14A,17A '-2026':13A,16A '1.13.0':27B,84C 'abort':69B,98C 'allow':94C 'array':4A,40B,103C 'attack':54B,96C,110C 'callback':67B,123C 'caus':47B 'cgo':50B,127C 'contain':85C 'convers':38B 'craft':2A,57B,113C 'crash':5A 'cve':12A,15A 'denial':31B,87C 'denial-of-servic':30B 'drop':74B 'element':46B,109C 'everi':10A,75B,131C 'flaw':34B 'flight':80B,136C 'frankenphp':1A,18B,25B,61B,82C,117C 'goarray':37B,92C 'host':24B 'in-flight':78B,134C 'integ':44B,107C 'integer-key':43B,106C 'json':3A,58B,114C 'key':45B,108C 'kubernet':19B 'log':62B,118C 'null':42B,105C 'panic':51B,128C 'pass':59B,115C 'php':20B 'process':8A,73B,101C 'remot':53B,95C 'request':11A,81B,137C 'return':64B,120C 'runtim':21B 'self':23B 'self-host':22B 'send':56B,112C 'server':7A,72B,100C 'servic':33B,89C 'termin':130C 'trigger':124C 'unrecov':49B,126C 'vhost':76B,132C 'via':102C 'vulner':90C 'whole':71B 'worker':66B,122C","nicknames":[],"mitigations":[],"who_affected":"FrankenPHP servers below 1.13.0 that pass request-derived JSON into frankenphp_log() or return it from worker callbacks are exposed. Servers that do not use worker mode or that never feed untrusted JSON into those paths are less likely to be reached. The sources do not say whether default configurations are affected in every case.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["frankenphp","high","kubernetes","php","runtime","selfhosted"],"campaign_type":null,"search_a":"'-128024':14A,17A '-2026':13A,16A 'array':4A 'craft':2A 'crash':5A 'cve':12A,15A 'everi':10A 'frankenphp':1A 'json':3A 'process':8A 'request':11A 'server':7A","search_b":"'1.13.0':27B 'abort':69B 'array':40B 'attack':54B 'callback':67B 'caus':47B 'cgo':50B 'convers':38B 'craft':57B 'denial':31B 'denial-of-servic':30B 'drop':74B 'element':46B 'everi':75B 'flaw':34B 'flight':80B 'frankenphp':18B,25B,61B 'goarray':37B 'host':24B 'in-flight':78B 'integ':44B 'integer-key':43B 'json':58B 'key':45B 'kubernet':19B 'log':62B 'null':42B 'panic':51B 'pass':59B 'php':20B 'process':73B 'remot':53B 'request':81B 'return':64B 'runtim':21B 'self':23B 'self-host':22B 'send':56B 'server':72B 'servic':33B 'unrecov':49B 'vhost':76B 'whole':71B 'worker':66B","search_c":"'1.13.0':84C 'abort':98C 'allow':94C 'array':103C 'attack':96C,110C 'callback':123C 'cgo':127C 'contain':85C 'craft':113C 'denial':87C 'element':109C 'everi':131C 'flight':136C 'frankenphp':82C,117C 'goarray':92C 'in-flight':134C 'integ':107C 'integer-key':106C 'json':114C 'key':108C 'log':118C 'null':105C 'panic':128C 'pass':115C 'process':101C 'remot':95C 'request':137C 'return':120C 'send':112C 'server':100C 'servic':89C 'termin':130C 'trigger':124C 'unrecov':126C 'vhost':132C 'via':102C 'vulner':90C 'worker':122C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-04T14:04:48+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-128024","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128024","severity":null,"published_at":"2026-11-13T10:18:08+00:00","modified_at":"2026-11-13T10:18:08+00:00","first_seen_at":"2026-11-13T10:47:31+00:00","fetched_at":"2026-11-13T10:47:31+00:00","note":null}],"documents":[{"id":145348,"url":"https://github.com/php/frankenphp/security/advisories/GHSA-4prg-hv4r-g6mv","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-04T14:04:48+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145349,"url":"https://www.vulncheck.com/advisories/frankenphp-before-1.13.0-denial-of-service-via-goarray-nil-type-assertion","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}