← Database

CVE-2026-128017

LOW CVSS: 3.7 Published: 2026-11-13 Modified: 2026-11-13

Description

FrankenPHP before 1.13.4 contains a double free vulnerability in worker mode that frees SG(request_info).content_type_dup twice when a worker script ends its loop after a non-form POST request. Unauthenticated attackers can send repeated JSON POST requests until the worker loop ends, aborting the whole process when USE_ZEND_ALLOC=0 is set.

Affected Platforms

Unknown

Weakness Type

CWE-415

References