{"id":"CVE-2026-128015","summary":"FrankenPHP before 1.13.4 Use-After-Free via putenv() During Request Shutdown","details":"FrankenPHP before 1.13.4 contains a use-after-free vulnerability that leaves a dangling pointer to a freed environment table when putenv() is called during request shutdown. Attackers triggering putenv() in shutdown functions, destructors, or session handlers can crash the process on the next getenv() call or leak previous request environment values.","aliases":["GHSA-rgpj-f2qx-xwhf"],"modified":"2026-11-14T07:04:33.170641244Z","published":"2026-11-13T09:34:11.325Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/128xxx/CVE-2026-128015.json","cna_assigner":"VulnCheck","cwe_ids":["CWE-416"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/128xxx/CVE-2026-128015.json"},{"type":"FIX","url":"https://github.com/php/frankenphp/commit/ab174aa6c27738b9ee56c97ac276d152bfb38f5e"},{"type":"ADVISORY","url":"https://github.com/php/frankenphp/security/advisories/GHSA-rgpj-f2qx-xwhf"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128015"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/frankenphp-before-1.13.4-use-after-free-via-putenv-during-request-shutdown"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/php/frankenphp","events":[{"introduced":"0"},{"fixed":"7f50be9d86261bf7cff9b051ab4fb572e95020ed"},{"fixed":"ab174aa6c27738b9ee56c97ac276d152bfb38f5e"}],"database_specific":{"extracted_events":[{"strategy":"StandardRange","range":[{"introduced":"0"},{"fixed":"1.13.4"}],"source":"AFFECTED_FIELD"},{"range":[{"fixed":"ab174aa6c27738b9ee56c97ac276d152bfb38f5e"}],"source":"REFERENCES_COMMIT"}]}}],"versions":["v1.13.3","caddy/v1.13.3","v1.13.2","caddy/v1.13.2","v1.13.0","caddy/v1.13.0","v1.13.1","caddy/v1.13.1","v1.12.7","caddy/v1.12.7","v1.12.6","caddy/v1.12.6","v1.12.5","caddy/v1.12.5","v1.12.4","caddy/v1.12.4","v1.12.3","caddy/v1.12.3","v1.12.2","caddy/v1.12.2","v1.12.1","caddy/v1.12.1","v1.12.0","caddy/v1.12.0","v1.11.3","caddy/v1.11.3","v1.11.2","caddy/v1.11.2","v1.11.1","caddy/v1.11.1","v1.11.0","caddy/v1.11.0","v1.10.1","caddy/v1.10.1","v1.10.0","caddy/v1.10.0","v1.9.1","caddy/v1.9.1","v1.9.0","caddy/v1.9.0","v1.8.0","caddy/v1.8.0","v1.7.0","caddy/v1.7.0","v1.6.2","caddy/v1.6.2","v1.6.1","caddy/v1.6.1","v1.6.0","caddy/v1.6.0","v1.5.0","caddy/v1.5.0","v1.4.4","caddy/v1.4.4","v1.4.3","caddy/v1.4.3","v1.4.2","caddy/v1.4.2","v1.4.1","caddy/v1.4.1","v1.4.0","caddy/v1.4.0","v1.3.6","caddy/v1.3.6","v1.3.5","caddy/v1.3.5","v1.3.4","caddy/v1.3.4","v1.3.3","caddy/v1.3.3","v1.3.2","caddy/v1.3.2","v1.3.1","caddy/v1.3.1","v1.3.0","caddy/v1.3.0","v1.2.5","caddy/v1.2.5","v1.2.4","caddy/v1.2.4","v1.2.3","caddy/v1.2.3","v1.2.2","caddy/v1.2.2","v1.2.1","caddy/v1.2.1","v1.2.0","caddy/v1.2.0","v1.1.5","caddy/v1.1.5","v1.1.4","caddy/v1.1.4","v1.1.3","caddy/v1.1.3","v1.1.2","caddy/v1.1.2","v1.1.1","caddy/v1.1.1","v1.1.0","caddy/v1.1.0","v1.0.3","caddy/v1.0.3","v1.0.2","caddy/v1.0.2","v1.0.1","caddy/v1.0.1","v1.0.0","caddy/v1.0.0","v1.0.0-rc.4","caddy/v1.0.0-rc.4","v1.0.0-rc.3","caddy/v1.0.0-rc.3","v1.0.0-rc.2","caddy/v1.0.0-rc.2","v1.0.0-beta.2","caddy/v1.0.0-beta.2","v1.0.0-beta.1","caddy/v1.0.0-beta.1"],"database_specific":{"vanir_signatures_modified":"2026-11-14T07:04:33Z","source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-128015.json","vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://github.com/php/frankenphp/commit/ab174aa6c27738b9ee56c97ac276d152bfb38f5e","target":{"function":"php_thread","file":"frankenphp.c"},"deprecated":false,"digest":{"function_hash":"164960425533216605526231931882613753575","length":2201},"id":"CVE-2026-128015-534e86d0"},{"deprecated":false,"digest":{"line_hashes":["258546639307883300611392191510898817971","58956416200876491839497053728963117523","287539342522478771647097462589902748621","326682421742183053591291768425490557714","33225960105219918821534967166315804319","291380925910879794992776255938900119279","238257003436279612235916845819039195533","270600929216329304430939880458366003452"],"threshold":0.9},"id":"CVE-2026-128015-e19f70bc","signature_type":"Line","signature_version":"v1","source":"https://github.com/php/frankenphp/commit/ab174aa6c27738b9ee56c97ac276d152bfb38f5e","target":{"file":"frankenphp.c"}}]}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N"}]}