Description
FrankenPHP before 1.13.2 contains an uncontrolled recursion vulnerability in its PHP-to-Go array converter that fails to detect circular references in PHP arrays. Passing a self-referential array to frankenphp_log() or returning one from a worker callback triggers a fatal Go stack overflow, terminating the entire server process.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| php | frankenphp | < 1.13.2 | 1.13.2 |
References
- GitHub Security Advisory (GHSA-ccgp-ch9h-533f) vendor-advisory
- VulnCheck Advisory: FrankenPHP before 1.13.2 Denial of Service via Cyclic Array Conversion third-party-advisory