CVE-2026-128022
FrankenPHP before 1.13.2 Denial of Service via Queued Disconnected Requests
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th
FrankenPHP before 1.13.2 contains a resource exhaustion vulnerability that allows unauthenticated clients to tie up PHP threads because queued requests are not cancelled when clients disconnect. Attackers can send many requests and close connections immediately, forcing handleRequestWithRegularPHPThreads and worker handlers to execute them and delay all clients sharing the thread pool.
| CWE | CWE-400 |
| Vendor | php |
| Product | frankenphp |
| Ecosystems | |
| Industries | Technology |
| Published | Nov 13, 2026 |
Stay Ahead of the Next One
Get instant alerts for php frankenphp
Be the first to know when new medium vulnerabilities affecting php frankenphp are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low
Affected Versions
php / frankenphp
0 < 1.13.2
References
Credits
🔍 alexandre-daubois