CVE-2026-128024
MEDIUM
NVD
CVSS Score
5.9
Severity
MEDIUM
Published
Nov 13, 2026
Vendor
unknown
Description
FrankenPHP before 1.13.0 contains a denial of service vulnerability in goArray() that allows remote attackers to abort the server process via arrays with null integer-keyed elements. Attackers can send crafted JSON passed to frankenphp_log() or returned from worker callbacks, triggering an unrecovered cgo panic that terminates every vhost and in-flight request.