CVE-2026-128016

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-128016
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-128016.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-128016
Aliases
  • GHSA-cm3q-jw2q-9rh5
Published
2026-11-13T09:34:10Z
Modified
2026-11-14T07:04:31Z
Severity
  • 8.3 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
FrankenPHP before 1.13.4 Use-After-Free of SplTempFileObject Streams in Worker Mode
Details

FrankenPHP before 1.13.4 contains a use-after-free vulnerability in worker mode that frees internal streams of SplTempFileObject or SplFileObject on php://temp instances surviving across requests. Remote clients can send requests reaching code that uses such persisted objects, causing reads of freed memory that leak garbage data or crash the process.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-416"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/128xxx/CVE-2026-128016.json"
}
References

Affected packages

Git / github.com/php/frankenphp

Affected ranges

Type
GIT
Repo
https://github.com/php/frankenphp
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
7f50be9d86261bf7cff9b051ab4fb572e95020ed
Fixed
837b76880b33a1a78ae4f27dea85bdcddb6cf70c
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "1.13.4"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "fixed": "837b76880b33a1a78ae4f27dea85bdcddb6cf70c"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

caddy/v1.*
caddy/v1.0.0
caddy/v1.0.0-beta.1
caddy/v1.0.0-beta.2
caddy/v1.0.0-rc.2
caddy/v1.0.0-rc.3
caddy/v1.0.0-rc.4
caddy/v1.0.1
caddy/v1.0.2
caddy/v1.0.3
caddy/v1.1.0
caddy/v1.1.1
caddy/v1.1.2
caddy/v1.1.3
caddy/v1.1.4
caddy/v1.1.5
caddy/v1.10.0
caddy/v1.10.1
caddy/v1.11.0
caddy/v1.11.1
caddy/v1.11.2
caddy/v1.11.3
caddy/v1.12.0
caddy/v1.12.1
caddy/v1.12.2
caddy/v1.12.3
caddy/v1.12.4
caddy/v1.12.5
caddy/v1.12.6
caddy/v1.12.7
caddy/v1.13.0
caddy/v1.13.1
caddy/v1.13.2
caddy/v1.13.3
caddy/v1.2.0
caddy/v1.2.1
caddy/v1.2.2
caddy/v1.2.3
caddy/v1.2.4
caddy/v1.2.5
caddy/v1.3.0
caddy/v1.3.1
caddy/v1.3.2
caddy/v1.3.3
caddy/v1.3.4
caddy/v1.3.5
caddy/v1.3.6
caddy/v1.4.0
caddy/v1.4.1
caddy/v1.4.2
caddy/v1.4.3
caddy/v1.4.4
caddy/v1.5.0
caddy/v1.6.0
caddy/v1.6.1
caddy/v1.6.2
caddy/v1.7.0
caddy/v1.8.0
caddy/v1.9.0
caddy/v1.9.1
v1.*
v1.0.0
v1.0.0-beta.1
v1.0.0-beta.2
v1.0.0-rc.2
v1.0.0-rc.3
v1.0.0-rc.4
v1.0.1
v1.0.2
v1.0.3
v1.1.0
v1.1.1
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.10.0
v1.10.1
v1.11.0
v1.11.1
v1.11.2
v1.11.3
v1.12.0
v1.12.1
v1.12.2
v1.12.3
v1.12.4
v1.12.5
v1.12.6
v1.12.7
v1.13.0
v1.13.1
v1.13.2
v1.13.3
v1.2.0
v1.2.1
v1.2.2
v1.2.3
v1.2.4
v1.2.5
v1.3.0
v1.3.1
v1.3.2
v1.3.3
v1.3.4
v1.3.5
v1.3.6
v1.4.0
v1.4.1
v1.4.2
v1.4.3
v1.4.4
v1.5.0
v1.6.0
v1.6.1
v1.6.2
v1.7.0
v1.8.0
v1.9.0
v1.9.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-128016.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "61749932404774749058622547131777589905",
            "length": 381
        },
        "id": "CVE-2026-128016-7dea2fb2",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/php/frankenphp/commit/837b76880b33a1a78ae4f27dea85bdcddb6cf70c",
        "target": {
            "file": "frankenphp.c",
            "function": "frankenphp_release_temporary_streams"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "307825890383858552951598718758432892847",
                "101905128533865807444774266841968693560",
                "112305683211282001441353274829886615466",
                "277870471153839224995762136245252257828",
                "42866658228711048222847353678524509298",
                "295511919799023127540566879510701204366",
                "224114692517672374708763822039612142105",
                "144523862302970318523981957967859650111",
                "207570164459806564070418392931563159179",
                "94781492250190132734642516563499890397",
                "143481429012611319850103224695901269983",
                "165538002201847684622143623105000323856",
                "154166201511119666745404407108051305778",
                "40611750597578056523494576126993104334",
                "172894932244458602056138198317818947630",
                "182274893247743195940421080051535893936",
                "115342406678140919599049970673890030508",
                "258913617991235475283124195077946483192",
                "269234163511115094604865390004481659976",
                "186347830775907160598092011593843971862",
                "265913928317581910033362835798761960666",
                "170503151221477831527479301743456479073",
                "190644492041911298716244649444726223995",
                "302843775411163888479342480886638963628",
                "84247887205805003969369036754195294073",
                "266054671544249501046020149197575594407",
                "51615747517488945222704417084746908790",
                "173300515666148833225307743070238667198",
                "99303361919102355821005269792083835798",
                "283602915022396643843819175631772372486",
                "132324765397341190251072404198913543755",
                "146941806697143823616807949044144839860"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-128016-a5f8784f",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/php/frankenphp/commit/837b76880b33a1a78ae4f27dea85bdcddb6cf70c",
        "target": {
            "file": "frankenphp.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "140942256914994902409809790442748064520",
            "length": 1567
        },
        "id": "CVE-2026-128016-af1516d0",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/php/frankenphp/commit/837b76880b33a1a78ae4f27dea85bdcddb6cf70c",
        "target": {
            "file": "frankenphp.c",
            "function": "frankenphp_worker_request_startup"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "59016952069717908782788411841036933374",
            "length": 780
        },
        "id": "CVE-2026-128016-c538bc7a",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/php/frankenphp/commit/837b76880b33a1a78ae4f27dea85bdcddb6cf70c",
        "target": {
            "file": "frankenphp.c",
            "function": "frankenphp_worker_request_shutdown"
        }
    }
]
vanir_signatures_modified 
"2026-11-14T07:04:31Z"