MEDIUMCVSS v3.1 6.5Vulnerability
CVE-2026-128016
FrankenPHP before 1.13.4 contains a use-after-free vulnerability in worker mode that frees internal streams of SplTempFileObject or SplFileObject on php://temp instances surviving across requests. Remote clients can send requests reaching code that uses such persisted objects, causing reads of freed memory that leak garbage data or crash the process.
Properties
- Severity
- MEDIUM
- Nvd fetched at
- 2026-11-14T00:40:25.638091+00:00
- Epss score
- 0.00453
- Cvss score
- 6.5
- Cvss severity
- MEDIUM
- Retrieved at
- 2026-11-14T00:51:03+00:00
- Score
- 6.5
- Last source
- FIRST EPSS
- Cvss version
- 3.1
- Cve id
- CVE-2026-128016
- Cvss vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H
- First seen by Signal
- 2026-11-13T17:31:47+00:00
- Vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H
- Published at
- 2026-11-13T10:18:06.807
- Last modified
- 2026-11-13T16:18:55.567
- Epss percentile
- 0.39865
Related Entities (1)
HAS_WEAKNESS (1)
Related research
Explore deeper with Ninja Signal's threat intelligence graph