CVE-2026-128022: FrankenPHP before 1.13.2 Denial of Service via Queued Disconnected Requests
FrankenPHP before 1.13.2 contains a resource exhaustion vulnerability that allows unauthenticated clients to tie up PHP threads because queued requests are not cancelled when clients disconnect. Attackers can send many requests and close connections immediately, forcing handleRequestWithRegularPHPThreads and worker handlers to execute them and delay all clients sharing the thread pool.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this denial-of-service issue?
FrankenPHP deployments using a version before 1.13.2 are exposed where clients can send requests to the server. The issue affects workloads that share a PHP thread pool, because queued disconnected requests can delay other clients using that pool.
What does an attacker need to exploit it?
An attacker does not need authentication or user interaction. They can repeatedly send requests and immediately close the connections, leaving the queued requests to execute and consume PHP threads.
Are default deployments affected?
The available information identifies the vulnerable behavior in regular PHP thread handling and worker handlers, but does not state whether every default configuration enables the affected paths.
What is the remediation?
Upgrade FrankenPHP to version 1.13.2 or later. The provided information does not specify a workaround for deployments that cannot be upgraded immediately.