PkgSeer

Vulnerability GO-2026-4442

Unknown

8 months ago

FrankenPHP has delayed propagation of security fixes in upstream base images in github.com/dunglas/frankenphp

v1.0.0-beta.1 - v1.13.1

Summary

FrankenPHP has delayed propagation of security fixes in upstream base images in github.com/dunglas/frankenphp

Details

FrankenPHP has delayed propagation of security fixes in upstream base images in github.com/dunglas/frankenphp.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/dunglas/frankenphp before v1.1.11.

References

ADVISORY — github.com

Related Vulnerabilities

Other vulnerabilities affecting the same packages

FrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared module

v1.0.0-beta.1 - v1.12.4 GHSA-v3ph-cgqh-r8p5

FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files in github.com/dunglas/frankenphp

v1.11.2 - v1.12.2 GO-2026-5084

FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files

v1.11.2 - v1.12.2 GHSA-3g8v-8r37-cgjm

FrankenPHP's unicode case-folding length expansion causes incorrect split_path index (SCRIPT_NAME/PATH_INFO confusion) in FrankenPHP in github.com/dunglas/frankenphp

v1.0.0-beta.1 - v1.11.1 GO-2026-4486

FrankenPHP leaks session data between requests in worker mode in github.com/dunglas/frankenphp

v1.0.0-beta.1 - v1.11.1 GO-2026-4489

View all vulnerabilities for these packages

Impacted packages

github.com/dunglas/frankenphp

Timeline

Published

8 months ago

Last Modified

7 months ago