Executive brief
FrankenPHP's unicode case-folding length expansion causes incorrect split_path index (SCRIPT_NAME/PATH_INFO confusion) in FrankenPHP in github.com/dunglas/frankenphp
Affected products
- Go github.com/dunglas/frankenphp
Junglewise Threat Intelligence
CVE-2026-24895: GO-2026-4486 - FrankenPHP's unicode case-folding length expansion causes incorrect split_path index (SCRIPT_NAME/PATH_INFO confusion) in FrankenPHP in gith
CVE-2026-24895 · Severity: medium · CVSS 4 · Published 2026-02-17
Vendors: Go.
Related threats
- FrankenPHP remote code execution via unsafe Unicode handling in CGI path splitting
- GO-2026-4442 - FrankenPHP has delayed propagation of security fixes in upstream base images in github.com/dunglas/frankenphp
- GO-2026-4489 - FrankenPHP leaks session data between requests in worker mode in github.com/dunglas/frankenphp
- FrankenPHP has delayed propagation of security fixes in upstream base images