HIGH8.1Go
GHSA-3g8v-8r37-cgjm· CVE-2026-45062, GO-2026-5084FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files
Modified: 6/25/2026
package
Go/github.com/dunglas/frankenphp
pkg:go/github.com/dunglas/frankenphp
HIGHGo
GHSA-g966-83w7-6w38· CVE-2026-24895, GO-2026-4486FrankenPHP's unicode case-folding length expansion causes incorrect split_path index (SCRIPT_NAME/PATH_INFO confusion) in FrankenPHP
Modified: 2/24/2026
HIGHGo
GHSA-r3xh-3r3w-47gp· CVE-2026-24894, GO-2026-4489FrankenPHP leaks session data between requests in worker mode
Modified: 2/19/2026
CRITICAL9.8Go
GHSA-x9p2-77v6-6vhf· GO-2026-4442FrankenPHP has delayed propagation of security fixes in upstream base images
Modified: 2/19/2026
—Go
GO-2026-4442· GHSA-x9p2-77v6-6vhfFrankenPHP has delayed propagation of security fixes in upstream base images in github.com/dunglas/frankenphp
Modified: 2/19/2026
—Go
GO-2026-4486· CVE-2026-24895, GHSA-g966-83w7-6w38FrankenPHP's unicode case-folding length expansion causes incorrect split_path index (SCRIPT_NAME/PATH_INFO confusion) in FrankenPHP in github.com/dunglas/frankenphp
Modified: 2/19/2026
—Go
GO-2026-4489· CVE-2026-24894, GHSA-r3xh-3r3w-47gpFrankenPHP leaks session data between requests in worker mode in github.com/dunglas/frankenphp
Modified: 2/19/2026
—Go
GO-2026-5084· CVE-2026-45062, GHSA-3g8v-8r37-cgjmFrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files in github.com/dunglas/frankenphp
Modified: 6/25/2026