Threats tagged 'ghsa-g5qv-p6x9-9wpv'

FrankenPHP standalone static binaries from version 1.8.0 up to but not including 1.13.2 include a statically linked PHP brotli extension with Brotli 1.2.0. This version of Brotli contains an out-of-bounds write vulnerability (CVE-2026-111497) in its decoder. Unauthenticated remote attackers can exploit this by sending crafted data to applications that use brotli_uncompress_add(), potentially causing the FrankenPHP process to crash and possibly leading to memory disclosure or code execution.