Read the docs
TI-2026-71918 Aliases CVE-2026-82416GHSA-v3ph-cgqh-r8p5

Session state leak across requests in FrankenPHP worker mode

Priority LOW 35CWE-362Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · High · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

FrankenPHP before 1.12.5 keeps PHP session state between requests in worker mode when the session extension is a shared module. Under concurrent requests, session_id() can return another client's identifier, exposing sessions across users and enabling possible session hijacking. A remote attacker needs no privileges or user interaction, but the attack complexity is high. Statically linked builds are not affected.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

FrankenPHP is a modern application server for PHP. Prior to 1.12.5, FrankenPHP worker mode can retain PHP session state between requests when the session extension is loaded as a shared module and is unavailable through HAVE_PHP_SESSION at compile time. In this build configuration, frankenphp_reset_session_state() is compiled out, PS(id) can survive a request boundary, and a subsequent session_start() can ignore the new request's cookie because an identifier is already present. Under concurrent requests, session_id() can therefore return another client's identifier or a stale identifier from a previous request on the same worker thread, causing cross-user session exposure, possible session hijacking, and intermittent logout behavior. Builds with the session extension statically linked, including the official static binaries and Docker images, are not affected. This issue is fixed in version 1.12.5.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00293 21st percentileScored 2026-11-07
Fix Fixed frankenphp (php): 1.12.5github.com/dunglas/frankenphp (Go): 1.12.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
PHPfrankenphpbefore 1.12.51.12.5Patch availableCNA
—github.com/dunglas/frankenphp (Go)before 1.12.51.12.5Patch availableGHSA-v3ph-cgqh-r8p5
  • frankenphp VendorPHP Affected before 1.12.5 Fixed in 1.12.5 Patch available CNA
  • github.com/dunglas/frankenphp (Go) Vendor— Affected before 1.12.5 Fixed in 1.12.5 Patch available GHSA-v3ph-cgqh-r8p5

Remediation

Upgrade php frankenphp and the github.com/dunglas/frankenphp Go module to version 1.12.5, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA frankenphp (php) Fixed in 1.12.5
  • Fix · GHSA-v3ph-cgqh-r8p5 github.com/dunglas/frankenphp (Go) Fixed in 1.12.5 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-13 Threatist record created from CVE-2026-82416
  2. 2026-10-13 CISA SSVC decision points changed
  3. 2026-10-13 Priority changed: MEDIUM → LOW
  4. 2026-10-16 Alias added: GHSA-v3ph-cgqh-r8p5
  5. 2026-10-16 Fix available: Go/github.com/dunglas/[email protected] · GHSA-v3ph-cgqh-r8p5
  6. 2026-10-16 CVSS score added · GHSA-v3ph-cgqh-r8p5
  7. 2026-10-16 Weakness changed · GHSA-v3ph-cgqh-r8p5
  8. 2026-10-16 6 new references · GHSA-v3ph-cgqh-r8p5
  9. 2026-11-06 Affected versions changed · Red Hat
  10. 2026-11-06 CVSS score added · Red Hat

References

Advisory 1

Other 5

  • TI-2024-04260 Argument Injection in PHP-CGI KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2016-08118 The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow… KEVCVSS 3.1CRITICAL 9.8
  • TI-2012-01607 sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI… KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-78794 PHP remote code execution via stale global state KEVCVSS 4.0CRITICAL 9.2
  • TI-2026-78793 Out-of-memory handling flaw in PHP allows remote code execution KEVCVSS 4.0CRITICAL 9.2
See all 777 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences