CVE-2026-128024 in FrankenPHP
Summary
by MITRE • 11/13/2026
FrankenPHP before 1.13.0 contains a denial of service vulnerability in goArray() that allows remote attackers to abort the server process via arrays with null integer-keyed elements. Attackers can send crafted JSON passed to frankenphp_log() or returned from worker callbacks, triggering an unrecovered cgo panic that terminates every vhost and in-flight request.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 11/13/2026
The vulnerability identified in FrankenPHP versions prior to 1.13.0 represents a critical denial of service flaw rooted in the improper handling of array structures within the goArray function. This specific implementation defect allows remote attackers to trigger an unrecovered panic in the underlying Go runtime, which subsequently terminates the entire server process. The root cause lies in how the application processes arrays containing null integer-keyed elements when these data structures are passed through critical logging or worker callback interfaces such as frankenphp_log(). When a crafted JSON payload is transmitted that results in the creation of an array with null keys during internal processing, the goArray function fails to validate or sanitize this input correctly. This failure leads directly to a cgo panic because the Go runtime cannot recover from certain types of invalid memory access or state corruption triggered by these malformed data structures.
From a technical perspective, the exploitation vector relies on the interaction between PHP code and the underlying C/Go bridge that FrankenPHP utilizes to serve HTTP requests via its embedded server architecture. When an attacker sends a specifically crafted JSON object containing arrays with null integer keys, this input is processed through functions like frankenphp_log or returned from worker callbacks. The internal conversion logic attempts to map these PHP array structures into Go-compatible formats but encounters the null key anomaly. Because the panic occurs in cgo code and is not caught by any recover mechanism within the execution path, it propagates up the stack, causing the entire server process to crash rather than just failing the individual request. This behavior effectively results in a complete service outage for all virtual hosts hosted on that instance, as well as terminating every currently in-flight request, leading to significant availability loss.
The operational impact of this vulnerability is severe due to its remote exploitability and the breadth of disruption it causes. Unlike typical denial of service vulnerabilities that might only affect a single connection or thread, this flaw compromises the stability of the entire server process. An attacker can achieve this by simply sending one crafted HTTP request containing the malicious JSON payload. The consequence is not merely a timeout for the requesting client but a total collapse of the web server environment. This means all active sessions are dropped, ongoing transactions are interrupted, and the service must be manually restarted to restore functionality. For environments relying on FrankenPHP for high-availability PHP applications, this represents a critical risk to business continuity and system reliability.
In terms of industry standard classifications, this vulnerability aligns with CWE-20 Improper Input Validation, as the application fails to adequately sanitize or validate array structures before processing them in low-level code paths. It also relates closely to CWE-789 Uncontrolled Memory Resource Consumption if viewed through the lens of resource exhaustion leading to process termination, though the primary mechanism is a logic error leading to an unrecovered panic. From a tactical perspective within the MITRE ATT&CK framework, this falls under T1499 Endpoint Denial of Service: OS Exhaustive Floods or T1529 System Shutdown Reboot if considering the outcome of process termination requiring restart. The attack vector is classified as Network-based with Low Complexity, allowing unauthenticated remote exploitation via standard HTTP protocols.
To mitigate this vulnerability, organizations running FrankenPHP must immediately upgrade to version 1.13.0 or later where these issues have been addressed by the development team through improved input validation and panic recovery mechanisms in the goArray function. Until an upgrade is feasible, administrators should implement strict input filtering at the network perimeter using Web Application Firewalls to block JSON payloads containing arrays with null integer keys. Additionally, deploying health checks that automatically restart the FrankenPHP process upon detecting a crash can help minimize downtime, although this does not prevent the initial denial of service event. It is also advisable to review application code for any direct usage of frankenphp_log or worker callbacks with untrusted input and ensure that all data passed through these interfaces is rigorously validated against expected schemas before reaching the vulnerable internal functions.