CVE-2026-24894
High · 7.5CVSS
7.5
EPSS
0.4%
Published
Feb 12, 2026
CISA due date
—
The record
FrankenPHP is a modern application server for PHP. Prior to 1.11.2, when running FrankenPHP in worker mode, the $_SESSION superglobal is not correctly reset between requests. This allows a subsequent request processed by the same worker to access the $_SESSION data of the previous request (potentially belonging to a different user) before session_start() is called. This vulnerability is fixed in 1.11.2.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/dunglas/frankenphp | 0 | 1.11.2 |
| openSUSE:Leap 15.6 | govulncheck-vulndb | 0 | 0.0.20260226T182644-150000.1.149.1 |
Related vulnerabilities
- GO-2026-4489 FrankenPHP leaks session data between requests in worker mode in… Same vulnerability
- CVE-2026-27590 Caddy is an extensible server platform that uses TLS by default. Also affects github.com/dunglas/frankenphp
- GO-2026-4442 FrankenPHP has delayed propagation of security fixes in upstream base images in… Also affects github.com/dunglas/frankenphp
- GO-2026-4486 FrankenPHP's unicode case-folding length expansion causes incorrect split_path index… Also affects github.com/dunglas/frankenphp
- CVE-2026-24895 FrankenPHP is a modern application server for PHP. Also affects github.com/dunglas/frankenphp
- CVE-2026-33990 Docker Model Runner (DMR) is software used to manage, run, and deploy AI models using… Also affects govulncheck-vulndb
- CVE-2026-34204 MinIO is a high-performance object storage system. Also affects govulncheck-vulndb
- CVE-2026-34041 act is a project which allows for local running of github actions. Also affects govulncheck-vulndb