Vulnerability GO-2026-6797
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
5 hours ago
October 19, 2026 at 09:08 PM UTC
FrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared module in github.com/dunglas/frankenphp
v1.0.0-beta.1 - v1.12.4
v1.0.0-beta.1 - v1.12.4
Summary
FrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared module in github.com/dunglas/frankenphp
Details
FrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared module in github.com/dunglas/frankenphp
Related Vulnerabilities
Other vulnerabilities affecting the same packages
High Risk
4 days ago
FrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared module
v1.0.0-beta.1 - v1.12.4 GHSA-v3ph-cgqh-r8p5
v1.0.0-beta.1 - v1.12.4 GHSA-v3ph-cgqh-r8p5
Unknown
3 months ago
FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files in github.com/dunglas/frankenphp
v1.11.2 - v1.12.2 GO-2026-5084
v1.11.2 - v1.12.2 GO-2026-5084
High Risk
5 months ago
FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files
v1.11.2 - v1.12.2 GHSA-3g8v-8r37-cgjm
v1.11.2 - v1.12.2 GHSA-3g8v-8r37-cgjm
Unknown
8 months ago
FrankenPHP has delayed propagation of security fixes in upstream base images in github.com/dunglas/frankenphp
v1.0.0-beta.1 - v1.13.1 GO-2026-4442
v1.0.0-beta.1 - v1.13.1 GO-2026-4442
Unknown
8 months ago
FrankenPHP's unicode case-folding length expansion causes incorrect split_path index (SCRIPT_NAME/PATH_INFO confusion) in FrankenPHP in github.com/dunglas/frankenphp
v1.0.0-beta.1 - v1.11.1 GO-2026-4486
v1.0.0-beta.1 - v1.11.1 GO-2026-4486
Impacted packages
Timeline
Published
5 hours ago
October 19, 2026 at 09:08 PM UTC
Fixed (v1.12.5)
3 months ago
July 18, 2026 at 07:08 PM UTC
Last Modified
4 hours ago
October 19, 2026 at 09:31 PM UTC