CVE-2026-128027FrankenPHP before 1.1.11 Delayed Propagation of Base Image Security Fixes

FrankenPHP Docker images before 1.1.11 were rebuilt only when new base image tags were created, so security fixes that Alpine, PHP, and Go applied under existing tags were not propagated. Remote attackers could exploit known flaws in the stale system libraries, such as CVE-2025-15467 in libcrypto3, to execute code.

9.3 CRITICALNot in KEVNVD: Deferred

Last updated: 2026-11-13 10:18 UTC

OverviewCVSS details

9.3CRITICALCVSS 4.0

Score source: VulnCheck (CNA)
NVD status: Deferred
Published: Nov 13, 2026
Assigner: VulnCheck

Affected

frankenphp (php)

Versions: before 1.1.11
Fixed in: 1.1.11

Exploitation

Public exploit: None listed
CISA KEV: Not listed
KEV due date: —

EPSS

No EPSS score yet.

CVSS 4.0 · VulnCheck (CNA)

9.3Critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Attack vector: Network
Attack complexity: Low
Attack requirements: None
Privileges required: None
User interaction: None
Confidentiality impact: High
Integrity impact: High
Availability impact: High
Confidentiality (other systems): None
Integrity (other systems): None
Availability (other systems): None

CVSS 3.1 · VulnCheck (CNA)

9.8Critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality impact: High
Integrity impact: High
Availability impact: High

NVD status: Deferred

Overview Affected Products References

Overview

Severity

Score	Severity	Version	Technologies Affected
9.3	CRITICAL	4.0VulnCheck (CNA)	Php Frankenphp
9.8	CRITICAL	3.1VulnCheck (CNA)	Php Frankenphp

Details

CVE ID: CVE-2026-128027
Status: Deferred
Assigner (CNA): VulnCheck
Published: Nov 13, 2026
Last modified: 2026-11-13 10:18 UTC
Weaknesses: CWE-1395 · Dependency on Vulnerable Third-Party Component

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-13 12:56 UTC.