CVE-2026-128015

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-128015
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-128015.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-128015
Aliases
  • GHSA-rgpj-f2qx-xwhf
Published
2026-11-13T09:34:11Z
Modified
2026-11-14T07:04:33Z
Severity
  • 8.3 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
FrankenPHP before 1.13.4 Use-After-Free via putenv() During Request Shutdown
Details

FrankenPHP before 1.13.4 contains a use-after-free vulnerability that leaves a dangling pointer to a freed environment table when putenv() is called during request shutdown. Attackers triggering putenv() in shutdown functions, destructors, or session handlers can crash the process on the next getenv() call or leak previous request environment values.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-416"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/128xxx/CVE-2026-128015.json"
}
References

Affected packages

Git / github.com/php/frankenphp

Affected ranges

Type
GIT
Repo
https://github.com/php/frankenphp
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
7f50be9d86261bf7cff9b051ab4fb572e95020ed
Fixed
ab174aa6c27738b9ee56c97ac276d152bfb38f5e
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "1.13.4"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "fixed": "ab174aa6c27738b9ee56c97ac276d152bfb38f5e"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

caddy/v1.*
caddy/v1.0.0
caddy/v1.0.0-beta.1
caddy/v1.0.0-beta.2
caddy/v1.0.0-rc.2
caddy/v1.0.0-rc.3
caddy/v1.0.0-rc.4
caddy/v1.0.1
caddy/v1.0.2
caddy/v1.0.3
caddy/v1.1.0
caddy/v1.1.1
caddy/v1.1.2
caddy/v1.1.3
caddy/v1.1.4
caddy/v1.1.5
caddy/v1.10.0
caddy/v1.10.1
caddy/v1.11.0
caddy/v1.11.1
caddy/v1.11.2
caddy/v1.11.3
caddy/v1.12.0
caddy/v1.12.1
caddy/v1.12.2
caddy/v1.12.3
caddy/v1.12.4
caddy/v1.12.5
caddy/v1.12.6
caddy/v1.12.7
caddy/v1.13.0
caddy/v1.13.1
caddy/v1.13.2
caddy/v1.13.3
caddy/v1.2.0
caddy/v1.2.1
caddy/v1.2.2
caddy/v1.2.3
caddy/v1.2.4
caddy/v1.2.5
caddy/v1.3.0
caddy/v1.3.1
caddy/v1.3.2
caddy/v1.3.3
caddy/v1.3.4
caddy/v1.3.5
caddy/v1.3.6
caddy/v1.4.0
caddy/v1.4.1
caddy/v1.4.2
caddy/v1.4.3
caddy/v1.4.4
caddy/v1.5.0
caddy/v1.6.0
caddy/v1.6.1
caddy/v1.6.2
caddy/v1.7.0
caddy/v1.8.0
caddy/v1.9.0
caddy/v1.9.1
v1.*
v1.0.0
v1.0.0-beta.1
v1.0.0-beta.2
v1.0.0-rc.2
v1.0.0-rc.3
v1.0.0-rc.4
v1.0.1
v1.0.2
v1.0.3
v1.1.0
v1.1.1
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.10.0
v1.10.1
v1.11.0
v1.11.1
v1.11.2
v1.11.3
v1.12.0
v1.12.1
v1.12.2
v1.12.3
v1.12.4
v1.12.5
v1.12.6
v1.12.7
v1.13.0
v1.13.1
v1.13.2
v1.13.3
v1.2.0
v1.2.1
v1.2.2
v1.2.3
v1.2.4
v1.2.5
v1.3.0
v1.3.1
v1.3.2
v1.3.3
v1.3.4
v1.3.5
v1.3.6
v1.4.0
v1.4.1
v1.4.2
v1.4.3
v1.4.4
v1.5.0
v1.6.0
v1.6.1
v1.6.2
v1.7.0
v1.8.0
v1.9.0
v1.9.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-128015.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "164960425533216605526231931882613753575",
            "length": 2201
        },
        "id": "CVE-2026-128015-534e86d0",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/php/frankenphp/commit/ab174aa6c27738b9ee56c97ac276d152bfb38f5e",
        "target": {
            "file": "frankenphp.c",
            "function": "php_thread"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "258546639307883300611392191510898817971",
                "58956416200876491839497053728963117523",
                "287539342522478771647097462589902748621",
                "326682421742183053591291768425490557714",
                "33225960105219918821534967166315804319",
                "291380925910879794992776255938900119279",
                "238257003436279612235916845819039195533",
                "270600929216329304430939880458366003452"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-128015-e19f70bc",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/php/frankenphp/commit/ab174aa6c27738b9ee56c97ac276d152bfb38f5e",
        "target": {
            "file": "frankenphp.c"
        }
    }
]
vanir_signatures_modified 
"2026-11-14T07:04:33Z"