Considerer documenting / disabling MPTCP by default due to CVE-2026-98432
Maintainers usually reply within 1 day
Assessment
- Difficulty
- 1/5
- Estimated time
- Under an hour
- Newbie friendliness
- 78/100
- Issue type
- Documentation
- Clarity
- Clearly specified
- Activity status
- Active
- Tech stack
- go, linux
- Domain
- documentation, security
Research direction
Start by reading the security and deployment documentation to choose where the mitigation note fits. Explain the MPTCP risk, the GODEBUG and sysctl mitigations, and that upgrading to a patched kernel is the real fix; done when the note gives operators these actions and the listener check.
Written by the indexing model from the issue text.
Description
Describe your feature request
CVE-2026-98432 is a critical (CVSS 9.8) use-after-free in the linux kernel's IPv4 TCP stack. A working remote root exploit has been demonstrated against servers that expose an MPTCP listener
Since Go 1.24, the net package enables MPTCP by default on linux listening sockets(when the kernel supports it).
Any public-facing Frankenphp instance running on an un patched Kernel with MPTCP enabled is potentially exposed to the demonstrated RCE path.
Add a short note in the security documentation or deployment.
Relevant references:
Go Security team announcement on CVE 2026-98432 and MPTCP defaults
Linux kernel stable commits addressing the use-after-free
Temporary mitigation:
Runtime: GODEBUG=multipathtcp=0
System-wide: sysctl -w net.mptcp.enabled=0 (require restarting Frankenphp)
after applying the mitigation and restarting: sudo ss -Mlnp (no frankenphp/caddy listeners should appear)
The real fix is to upgrade to a patched kernel
- Dominant language
- Go
- Stars
- 11.5k
- Forks
- 510
- Avg merge
- 1d 9h
- Merged PRs (30d)
- 69
Getting set up
- Ships a Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from php/frankenphp
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
php/frankenphp#2829 ·
Maintainers usually reply within 1 day
-
Difficulty 1/5 Under an hour Newbie friendliness 90/100
php/frankenphp#2671 · 1 comment ·
Maintainers usually reply within 1 day
-
Include frankenphp version in logsMay be free again A pull request for this issue was closed without being merged. Openenhancement
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
php/frankenphp#2483 · 3 comments ·
Maintainers usually reply within 1 day
-
suggestion about compile.mdMay be free again A pull request for this issue was closed without being merged. Openenhancement
Difficulty 1/5 1-3 hours Newbie friendliness 68/100
php/frankenphp#601 · 5 comments ·
Maintainers usually reply within 1 day
-
bug
Difficulty 1/5 1-3 hours Newbie friendliness 25/100
php/frankenphp#2822 · 1 comment ·
Maintainers usually reply within 1 day
Similar issues
-
bug
Difficulty 1/5 Under an hour Newbie friendliness 88/100
Maintainers usually reply within 1 day
-
tech-debt
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
Maintainers usually reply within 1 day
-
kind/bug
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Maintainers usually reply within 2 days
-
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
teradata-labs/loom#624 ·
Maintainers usually reply within 1 day
-
enhancement ruby
Difficulty 2/5 1-3 hours Newbie friendliness 64/100
open-telemetry/opentelemetry-lambda#2741 ·
Maintainers usually reply within 2 days