GO-2026-5444 vulnerabilities

Vulnerabilities for packages: frankenphp-8.5, frankenphp-8.2, frankenphp-8.4, frankenphp-8.3...

GO-2026-4775 vulnerabilities

Vulnerabilities for packages: caddy-fips, caddy, step-issuer-fips, frankenphp-8.4, frankenphp-8.2, step-ca-fips, frankenphp-8.5, frankenphp-8.3...

GO-2026-4923 vulnerabilities

Vulnerabilities for packages: datadog-agent-fips, datadog-agent, grafana, kine, loki, frankenphp-8.4, commercial-expanso-edge, mattermost-fips, frankenphp-8.2, mattermost, rke2-runtime-fips, frankenphp-8.5, commercial-grafana, k3s, containerd, elastic-agent-fips, frankenphp-8.3, beats-fips,...

SUSE CVE-2026-45062

FrankenPHP is a modern application server for PHP. From version 1.11.2 to before version 1.12.3, the splitPos function in cgi.go misuses golang.org/x/text/search with search.IgnoreCase when the request path contains a non-ASCII byte. Two distinct flaws in that fallback let an attacker mislead...

GHSA-JPCW-4WR7-C3VQ vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-codestarconnections, crossplane-provider-aws-elastictranscoder-fips, terraform-provider-grafana-fips, crossplane-provider-aws-ecrpublic, crossplane-provider-aws-rds, crossplane-provider-aws-gamelift-fips, crossplane-provider-aws-athena-fips,...

GHSA-R277-6W6Q-XMQW vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-codestarconnections, crossplane-provider-aws-elastictranscoder-fips, terraform-provider-grafana-fips, crossplane-provider-aws-ecrpublic, crossplane-provider-aws-rds, crossplane-provider-aws-gamelift-fips, crossplane-provider-aws-athena-fips,...

GHSA-XCGV-8MV7-V8C7 vulnerabilities

Vulnerabilities for packages: cloud-sql-proxy, azure-aad-pod-identity-mic, podman, commercial-chainloop-backend, gatekeeper, frankenphp-8.2, karpenter, nerdctl, keda, atlantis-fips, ocm-cli-fips, prometheus, helmfile, pulumi-language-dotnet, nerdctl-fips, chainloop-cli, cilium-fips, docker,...

GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: drone, gatekeeper, frankenphp-8.2, nerdctl, frankenphp-8.5, prometheus, opentelemetry-collector, gatekeeper-fips, rancher, containerd, knative-kafka-broker-fips, cert-manager, nemo, skaffold-fips, prometheus-elasticsearch-exporter, knative-serving-fips, spire-server,...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: drone, gatekeeper, frankenphp-8.2, nerdctl, frankenphp-8.5, prometheus, opentelemetry-collector, gatekeeper-fips, rancher, containerd, knative-kafka-broker-fips, cert-manager, nemo, skaffold-fips, prometheus-elasticsearch-exporter, knative-serving-fips, spire-server,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: sops, podman, drone, flux-notification-controller, gatekeeper, flux-notification-controller-fips, frankenphp-8.2, nerdctl, crossplane-provider-azure-securityinsights, sops-fips, atlantis-fips, frankenphp-8.5, packer, prometheus, crossplane-provider-azure-spring,...

GHSA-78MQ-XCR3-XM33 vulnerabilities

Vulnerabilities for packages: podman, gatekeeper, frankenphp-8.2, nerdctl, frankenphp-8.5, packer, prometheus, pulumi-language-dotnet, opentelemetry-collector, chainctl, chainloop-cli, gatekeeper-fips, wolfictl, apko, containerd, knative-kafka-broker-fips, cert-manager, splunk-otel-collector-fips...

GHSA-Q4H4-GMJ2-QVW2 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-rds, crossplane-provider-aws-athena-fips, crossplane-provider-aws-sesv2-fips, terraform-provider-azapi, chainloop-control-plane-fips, crossplane-provider-aws-s3-fips, packer, crossplane-provider-aws-sesv2, crossplane-provider-azure-spring,...

GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-rds, crossplane-provider-aws-athena-fips, crossplane-provider-aws-sesv2-fips, terraform-provider-azapi, chainloop-control-plane-fips, crossplane-provider-aws-s3-fips, packer, crossplane-provider-aws-sesv2, crossplane-provider-azure-spring,...

GHSA-9M57-25V3-79X9 vulnerabilities

Vulnerabilities for packages: podman, gatekeeper, frankenphp-8.2, nerdctl, frankenphp-8.5, packer, prometheus, opentelemetry-collector, docker-cli-buildx, gatekeeper-fips, rancher, containerd, knative-kafka-broker-fips, cert-manager, nemo, prometheus-elasticsearch-exporter, knative-serving-fips,...

GO-2026-5084 FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files in github.com/dunglas/frankenphp

FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files in github.com/dunglas/frankenphp...

SUSE CVE-2026-24895

FrankenPHP is a modern application server for PHP. Prior to 1.11.2, FrankenPHP's CGI path splitting logic improperly handles Unicode characters during case conversion. The logic computes the split index for finding .php on a lowercased copy of the request path but applies that byte index to the...

CVE-2026-45062 FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files

FrankenPHP is a modern application server for PHP. From version 1.11.2 to before version 1.12.3, the splitPos function in cgi.go misuses golang.org/x/text/search with search.IgnoreCase when the request path contains a non-ASCII byte. Two distinct flaws in that fallback let an attacker mislead...

EUVD-2026-36075

FrankenPHP is a modern application server for PHP. From version 1.11.2 to before version 1.12.3, the splitPos function in cgi.go misuses golang.org/x/text/search with search.IgnoreCase when the request path contains a non-ASCII byte. Two distinct flaws in that fallback let an attacker mislead...

CVE-2026-45062

CVE-2026-45062 affects FrankenPHP (versions 1.11.2–1.12.2). The vulnerability arises in the CGI path splitting logic (splitPos in cgi.go), where fallback matching uses golang.org/x/text/search with ignore-case, and engages when the request path contains non-ASCII bytes. Two flaws enable an attack...

CVE-2026-45062 FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files

FrankenPHP is a modern application server for PHP. From version 1.11.2 to before version 1.12.3, the splitPos function in cgi.go misuses golang.org/x/text/search with search.IgnoreCase when the request path contains a non-ASCII byte. Two distinct flaws in that fallback let an attacker mislead...