CVE-2026-128022

EUVD-2026-125080
FrankenPHP before 1.13.2 contains a resource exhaustion vulnerability that allows unauthenticated clients to tie up PHP threads because queued requests are not cancelled when clients disconnect. Attackers can send many requests and close connections immediately, forcing handleRequestWithRegularPHPThreads and worker handlers to execute them and delay all clients sharing the thread pool.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
5.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: 36.63%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
phpfrankenphp
𝑥
< 1.13.2
CNA
Common Weakness Enumeration
References
https://github.com/php/frankenphp/security/advisories/GHSA-fq24-r53r-xcx3
https://www.vulncheck.com/advisories/frankenphp-before-1.13.2-denial-of-service-via-queued-disconnected-requests