Vulnerability GO-2026-4486
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
8 months ago
February 17, 2026 at 06:09 PM UTC
FrankenPHP's unicode case-folding length expansion causes incorrect split_path index (SCRIPT_NAME/PATH_INFO confusion) in FrankenPHP in github.com/dunglas/frankenphp
v1.0.0-beta.1 - v1.11.1
v1.0.0-beta.1 - v1.11.1
Summary
FrankenPHP's unicode case-folding length expansion causes incorrect split_path index (SCRIPT_NAME/PATH_INFO confusion) in FrankenPHP in github.com/dunglas/frankenphp
Details
FrankenPHP's unicode case-folding length expansion causes incorrect split_path index (SCRIPT_NAME/PATH_INFO confusion) in FrankenPHP in github.com/dunglas/frankenphp
Related Vulnerabilities
Other vulnerabilities affecting the same packages
High Risk
6 hours ago
FrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared module
v1.0.0-beta.1 - v1.12.4 GHSA-v3ph-cgqh-r8p5
v1.0.0-beta.1 - v1.12.4 GHSA-v3ph-cgqh-r8p5
Unknown
3 months ago
FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files in github.com/dunglas/frankenphp
v1.11.2 - v1.12.2 GO-2026-5084
v1.11.2 - v1.12.2 GO-2026-5084
High Risk
5 months ago
FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files
v1.11.2 - v1.12.2 GHSA-3g8v-8r37-cgjm
v1.11.2 - v1.12.2 GHSA-3g8v-8r37-cgjm
Unknown
8 months ago
FrankenPHP has delayed propagation of security fixes in upstream base images in github.com/dunglas/frankenphp
v1.0.0-beta.1 - v1.13.1 GO-2026-4442
v1.0.0-beta.1 - v1.13.1 GO-2026-4442
Unknown
8 months ago
FrankenPHP leaks session data between requests in worker mode in github.com/dunglas/frankenphp
v1.0.0-beta.1 - v1.11.1 GO-2026-4489
v1.0.0-beta.1 - v1.11.1 GO-2026-4489
Impacted packages
Timeline
Published
8 months ago
February 17, 2026 at 06:09 PM UTC
Fixed (v1.11.2)
8 months ago
February 12, 2026 at 09:58 AM UTC
Last Modified
7 months ago
February 19, 2026 at 08:41 PM UTC