CVE-2026-122233
3.7 LOWpublic exploit availablePublished 2026-11-04 · Updated 2026-11-04
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
FrankenPHP before 1.13.4 contains an information disclosure vulnerability in worker mode that fails to clear last HTTP stream response headers between requests, because the reset only happens in RSHUTDOWN, which worker requests skip. Later requests calling http_get_last_response_headers() can read headers fetched by earlier requests on the same worker thread, exposing other users' Set-Cookie or token headers from backend APIs.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-488
Public exploit & PoC references
All references
- https://github.com/php/frankenphp/commit/3fade63bb1c1d246926ed8a00520015f94cdc819
- https://github.com/php/frankenphp/releases/tag/v1.13.4
- https://github.com/php/frankenphp/security/advisories/GHSA-pmvg-8483-mw84
- https://www.vulncheck.com/advisories/frankenphp-before-1.13.4-cross-request-response-header-leak-in-worker-mode
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- MEDIUMCVE-2026-103544PoC
- MEDIUMCVE-2026-103868
- MEDIUMCVE-2026-103869
- UNSCOREDCVE-2026-112921PoC
- HIGHCVE-2026-114637PoC
- HIGHCVE-2026-115419PoC
- UNSCOREDCVE-2026-120634PoC
- HIGHCVE-2026-121966PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.