{"id":"CVE-2026-128022","aliases":[],"cve":{"records":[{"id":"CVE-2026-128022","source":"VulnCheck","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-11-12T20:32:53.532Z","published":"2026-11-13T09:34:06.526Z","modified":"2026-11-13T09:34:06.526Z"}],"publishers":[{"name":"VulnCheck","role":"CNA","organizationId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","modified":"2026-11-13T09:34:06.526Z"}],"references":[{"url":"https://github.com/php/frankenphp/security/advisories/GHSA-fq24-r53r-xcx3","tags":["vendor-advisory"],"source":"VulnCheck"},{"url":"https://www.vulncheck.com/advisories/frankenphp-before-1.13.2-denial-of-service-via-queued-disconnected-requests","tags":["third-party-advisory"],"source":"VulnCheck"}],"weaknesses":[{"id":"CWE-400","description":"Uncontrolled Resource Consumption","source":"VulnCheck"}],"applicability":[{"source":"VulnCheck","statements":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:php:frankenphp:*:*:*:*:*:*:*:*","versionEndExcluding":"1.13.2"}]}]}]}],"prioritization":[]},"title":"FrankenPHP before 1.13.2 Denial of Service via Queued Disconnected Requests","titleSource":"VulnCheck","descriptionSource":"VulnCheck","description":"FrankenPHP before 1.13.2 contains a resource exhaustion vulnerability that allows unauthenticated clients to tie up PHP threads because queued requests are not cancelled when clients disconnect. Attackers can send many requests and close connections immediately, forcing handleRequestWithRegularPHPThreads and worker handlers to execute them and delay all clients sharing the thread pool.","score":6.9,"severity":"medium","published":"2026-11-13T09:34:06.526Z","modified":"2026-11-13T09:34:06.526Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"php","name":"frankenphp","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"1.13.2","versionType":"semver"},{"version":"1.13.2","status":"unaffected","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/dunglas/frankenphp","packageIdentity":{"ecosystem":"Go","name":"github.com/dunglas/frankenphp"},"cpes":[],"source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2026-128022"}],"remediation":[],"references":["https://github.com/php/frankenphp/security/advisories/GHSA-fq24-r53r-xcx3","https://www.vulncheck.com/advisories/frankenphp-before-1.13.2-denial-of-service-via-queued-disconnected-requests"],"sources":[{"name":"CVE","id":"CVE-2026-128022","modified":"2026-11-13T09:34:06.526Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-128022"}],"assessments":[{"source":"VulnCheck","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","score":6.9},{"source":"VulnCheck","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","score":5.3}],"sourceAffected":[],"observedAt":"2026-11-13T12:49:48.906Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T03:00:33.317Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-14T08:45:32.592Z","attemptedAt":"2026-11-14T08:45:32.592Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-14T08:35:36.014Z","attemptedAt":"2026-11-14T08:35:36.014Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-14T08:25:31.923Z","attemptedAt":"2026-11-14T08:25:31.923Z"},{"source":"EPSS","status":"available","checkedAt":"2026-11-14T08:25:31.674Z","attemptedAt":"2026-11-14T08:25:31.674Z"}],"evidence":[{"source":"FIRST EPSS","id":"CVE-2026-128022","url":"https://www.first.org/epss/","probability":0.00418,"percentile":0.36631,"date":"2026-11-13","checkedAt":"2026-11-14T08:25:31.674Z"},{"source":"ENISA EUVD","id":"EUVD-2026-125080","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-125080","modified":"Nov 13, 2026, 9:34:06 AM","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","checkedAt":"2026-11-14T08:25:31.923Z"},{"source":"GitHub Advisory Database","id":"GHSA-v6wj-g446-23hf","url":"https://github.com/advisories/GHSA-v6wj-g446-23hf","modified":"2026-11-13T12:31:37Z","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","checkedAt":"2026-11-14T08:35:36.014Z"},{"source":"NVD","id":"CVE-2026-128022","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128022","modified":"2026-11-13T10:18:07.890","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","checkedAt":"2026-11-14T08:45:32.592Z"},{"source":"NVD","id":"CVE-2026-128022","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128022","modified":"2026-11-13T10:18:07.890","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","checkedAt":"2026-11-14T08:45:32.592Z"}],"aiSummary":{"text":"FrankenPHP before 1.13.2 has a resource exhaustion vulnerability, allowing unauthenticated clients to tie up PHP threads by sending many requests and closing connections immediately. This forces threads to execute the requests, delaying all clients sharing the thread pool. Attackers need network access to exploit this weakness.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-13T13:56:11.102Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-128022"}]}}