CVE-2026-128022
MEDIUM
NVD
CVSS Score
5.3
Severity
MEDIUM
Published
Nov 13, 2026
Vendor
unknown
Description
FrankenPHP before 1.13.2 contains a resource exhaustion vulnerability that allows unauthenticated clients to tie up PHP threads because queued requests are not cancelled when clients disconnect. Attackers can send many requests and close connections immediately, forcing handleRequestWithRegularPHPThreads and worker handlers to execute them and delay all clients sharing the thread pool.