ETK-2026-2671Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-2671",
  "cve_id": null,
  "display_id": "ETK-2026-2671",
  "ghsa_id": "GHSA-p746-jj3f-94p8",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "Out-of-bounds write in FrankenPHP Brotli decoder",
  "summary": "FrankenPHP standalone static binaries from 1.8.0 through 1.13.1 include a vulnerable Brotli decoder. An unauthenticated attacker may crash the FrankenPHP process when an application decompresses attacker-controlled data through the PHP Brotli APIs; potential memory disclosure or code execution has not been demonstrated in FrankenPHP.",
  "mitigation": "Upgrade standalone FrankenPHP static binaries to 1.13.2 or later, and avoid passing untrusted data to PHP Brotli decompression APIs until upgraded. For affected Docker or Windows deployments using Brotli through PHP curl, upgrade to 1.13.4 or later.",
  "vendor": "go",
  "product": "go:github.com/dunglas/frankenphp",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 1.8.0, < 1.13.2"
      ],
      "ecosystem": "go",
      "fixed_versions": [
        "1.13.2"
      ],
      "package_name": "github.com/dunglas/frankenphp",
      "purl": "pkg:golang/github.com/dunglas/frankenphp"
    }
  ],
  "cwes": [
    252
  ],
  "cvss_score": 8.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 24.637176416666666,
  "t0_at": null,
  "signals": {
    "trigger_signal": {
      "at": "2026-10-26T16:53:50+00:00",
      "days": -0.13536464658564815,
      "is_lower_bound": true,
      "measured_at": "2026-10-26T20:08:45.704268+00:00",
      "url": "https://github.com/php/frankenphp/security/advisories/GHSA-p746-jj3f-94p8"
    }
  }
}