CVE-2026-24894 Details

A session leakage vulnerability has been identified in FrankenPHP, a modern application server for PHP, in versions prior to 1.11.2. When running in worker mode, the $_SESSION superglobal is not properly reset between requests. This allows a request processed by the same worker to access $_SESSION data from a previous request, potentially belonging to a different user, before session_start() is called. The vulnerability arises because $_SESSION is stored in the Zend Engine's symbol table, and the standard PHP request shutdown does not remove the variable from the symbol table, leading to data leakage between requests.

Users are advised to upgrade to FrankenPHP version 1.11.2, which addresses this vulnerability by ensuring that the $_SESSION variable is properly reset between requests in worker mode.