{"id":"CVE-2026-128016","summary":"FrankenPHP before 1.13.4 Use-After-Free of SplTempFileObject Streams in Worker Mode","details":"FrankenPHP before 1.13.4 contains a use-after-free vulnerability in worker mode that frees internal streams of SplTempFileObject or SplFileObject on php://temp instances surviving across requests. Remote clients can send requests reaching code that uses such persisted objects, causing reads of freed memory that leak garbage data or crash the process.","aliases":["GHSA-cm3q-jw2q-9rh5"],"modified":"2026-11-14T07:04:31.639721280Z","published":"2026-11-13T09:34:10.667Z","database_specific":{"cwe_ids":["CWE-416"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/128xxx/CVE-2026-128016.json","cna_assigner":"VulnCheck"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/128xxx/CVE-2026-128016.json"},{"type":"FIX","url":"https://github.com/php/frankenphp/commit/837b76880b33a1a78ae4f27dea85bdcddb6cf70c"},{"type":"ADVISORY","url":"https://github.com/php/frankenphp/security/advisories/GHSA-cm3q-jw2q-9rh5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128016"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/frankenphp-before-1.13.4-use-after-free-of-spltempfileobject-streams-in-worker-mode"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/php/frankenphp","events":[{"introduced":"0"},{"fixed":"7f50be9d86261bf7cff9b051ab4fb572e95020ed"},{"fixed":"837b76880b33a1a78ae4f27dea85bdcddb6cf70c"}],"database_specific":{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StandardRange","range":[{"introduced":"0"},{"fixed":"1.13.4"}]},{"range":[{"fixed":"837b76880b33a1a78ae4f27dea85bdcddb6cf70c"}],"source":"REFERENCES_COMMIT"}]}}],"versions":["v1.13.3","caddy/v1.13.3","v1.13.2","caddy/v1.13.2","v1.13.0","caddy/v1.13.0","v1.13.1","caddy/v1.13.1","v1.12.7","caddy/v1.12.7","v1.12.6","caddy/v1.12.6","v1.12.5","caddy/v1.12.5","v1.12.4","caddy/v1.12.4","v1.12.3","caddy/v1.12.3","v1.12.2","caddy/v1.12.2","v1.12.1","caddy/v1.12.1","v1.12.0","caddy/v1.12.0","v1.11.3","caddy/v1.11.3","v1.11.2","caddy/v1.11.2","v1.11.1","caddy/v1.11.1","v1.11.0","caddy/v1.11.0","v1.10.1","caddy/v1.10.1","v1.10.0","caddy/v1.10.0","v1.9.1","caddy/v1.9.1","v1.9.0","caddy/v1.9.0","v1.8.0","caddy/v1.8.0","v1.7.0","caddy/v1.7.0","v1.6.2","caddy/v1.6.2","v1.6.1","caddy/v1.6.1","v1.6.0","caddy/v1.6.0","v1.5.0","caddy/v1.5.0","v1.4.4","caddy/v1.4.4","v1.4.3","caddy/v1.4.3","v1.4.2","caddy/v1.4.2","v1.4.1","caddy/v1.4.1","v1.4.0","caddy/v1.4.0","v1.3.6","caddy/v1.3.6","v1.3.5","caddy/v1.3.5","v1.3.4","caddy/v1.3.4","v1.3.3","caddy/v1.3.3","v1.3.2","caddy/v1.3.2","v1.3.1","caddy/v1.3.1","v1.3.0","caddy/v1.3.0","v1.2.5","caddy/v1.2.5","v1.2.4","caddy/v1.2.4","v1.2.3","caddy/v1.2.3","v1.2.2","caddy/v1.2.2","v1.2.1","caddy/v1.2.1","v1.2.0","caddy/v1.2.0","v1.1.5","caddy/v1.1.5","v1.1.4","caddy/v1.1.4","v1.1.3","caddy/v1.1.3","v1.1.2","caddy/v1.1.2","v1.1.1","caddy/v1.1.1","v1.1.0","caddy/v1.1.0","v1.0.3","caddy/v1.0.3","v1.0.2","caddy/v1.0.2","v1.0.1","caddy/v1.0.1","v1.0.0","caddy/v1.0.0","v1.0.0-rc.4","caddy/v1.0.0-rc.4","v1.0.0-rc.3","caddy/v1.0.0-rc.3","v1.0.0-rc.2","caddy/v1.0.0-rc.2","v1.0.0-beta.2","caddy/v1.0.0-beta.2","v1.0.0-beta.1","caddy/v1.0.0-beta.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-128016.json","vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"61749932404774749058622547131777589905","length":381},"id":"CVE-2026-128016-7dea2fb2","signature_type":"Function","signature_version":"v1","source":"https://github.com/php/frankenphp/commit/837b76880b33a1a78ae4f27dea85bdcddb6cf70c","target":{"file":"frankenphp.c","function":"frankenphp_release_temporary_streams"}},{"target":{"file":"frankenphp.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["307825890383858552951598718758432892847","101905128533865807444774266841968693560","112305683211282001441353274829886615466","277870471153839224995762136245252257828","42866658228711048222847353678524509298","295511919799023127540566879510701204366","224114692517672374708763822039612142105","144523862302970318523981957967859650111","207570164459806564070418392931563159179","94781492250190132734642516563499890397","143481429012611319850103224695901269983","165538002201847684622143623105000323856","154166201511119666745404407108051305778","40611750597578056523494576126993104334","172894932244458602056138198317818947630","182274893247743195940421080051535893936","115342406678140919599049970673890030508","258913617991235475283124195077946483192","269234163511115094604865390004481659976","186347830775907160598092011593843971862","265913928317581910033362835798761960666","170503151221477831527479301743456479073","190644492041911298716244649444726223995","302843775411163888479342480886638963628","84247887205805003969369036754195294073","266054671544249501046020149197575594407","51615747517488945222704417084746908790","173300515666148833225307743070238667198","99303361919102355821005269792083835798","283602915022396643843819175631772372486","132324765397341190251072404198913543755","146941806697143823616807949044144839860"]},"id":"CVE-2026-128016-a5f8784f","signature_type":"Line","signature_version":"v1","source":"https://github.com/php/frankenphp/commit/837b76880b33a1a78ae4f27dea85bdcddb6cf70c"},{"deprecated":false,"digest":{"length":1567,"function_hash":"140942256914994902409809790442748064520"},"id":"CVE-2026-128016-af1516d0","signature_type":"Function","signature_version":"v1","source":"https://github.com/php/frankenphp/commit/837b76880b33a1a78ae4f27dea85bdcddb6cf70c","target":{"file":"frankenphp.c","function":"frankenphp_worker_request_startup"}},{"digest":{"function_hash":"59016952069717908782788411841036933374","length":780},"id":"CVE-2026-128016-c538bc7a","signature_type":"Function","signature_version":"v1","source":"https://github.com/php/frankenphp/commit/837b76880b33a1a78ae4f27dea85bdcddb6cf70c","target":{"file":"frankenphp.c","function":"frankenphp_worker_request_shutdown"},"deprecated":false}],"vanir_signatures_modified":"2026-11-14T07:04:31Z"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N"}]}