Description
FrankenPHP before 1.13.0 contains a denial of service vulnerability in goArray() that allows remote attackers to abort the server process via arrays with null integer-keyed elements. Attackers can send crafted JSON passed to frankenphp_log() or returned from worker callbacks, triggering an unrecovered cgo panic that terminates every vhost and in-flight request.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| php | frankenphp | < 1.13.0 | 1.13.0 |
References
- GitHub Security Advisory (GHSA-4prg-hv4r-g6mv) vendor-advisory
- VulnCheck Advisory: FrankenPHP before 1.13.0 Denial of Service via goArray Nil Type Assertion third-party-advisory