FrankenPHP before 1.13.2 Denial of Service via Queued Disconnected Requests
Summary
FrankenPHP before 1.13.2 contains a resource exhaustion vulnerability that allows unauthenticated clients to tie up PHP threads because queued requests are not cancelled when clients disconnect. Attackers can send many requests and close connections immediately, forcing handleRequestWithRegularPHPTh...
Affected packages
| Package | Affected → Fixed | |
|---|---|---|
| phpfrankenphp |
< 1.13.2→ 1.13.2 |
1.13.2 |
Original description The description as published by the source.
FrankenPHP before 1.13.2 contains a resource exhaustion vulnerability that allows unauthenticated clients to tie up PHP threads because queued requests are not cancelled when clients disconnect. Attackers can send many requests and close connections immediately, forcing handleRequestWithRegularPHPThreads and worker handlers to execute them and delay all clients sharing the thread pool.
Source: CVE.org (CVE Program・cvelistV5) NVD