馃寪 US-Proxy
class="logged-out env-production page-responsive" style="word-wrap: break-word;" >
Skip to content

fix: reset session state when session ext is not linked at build time - #2523

Merged
dunglas merged 1 commit into
mainfrom
fix/ghsa-v3ph-cgqh-r8p5-session-bleed
Jul 18, 2026
Merged

fix: reset session state when session ext is not linked at build time#2523
dunglas merged 1 commit into
mainfrom
fix/ghsa-v3ph-cgqh-r8p5-session-bleed

Conversation

@dunglas

@dunglas dunglas commented Jul 18, 2026

Copy link
Copy Markdown
Member

Resets the PHP session module between worker requests when the session extension is not visible at FrankenPHP compile time (i.e. loaded as a shared module), so a session id cannot bleed across concurrent clients.

When HAVE_PHP_SESSION is undefined, frankenphp_reset_session_state() is compiled out and PS(id) survived the request boundary; session_start() then ignored the request cookie and reused the previous id. The module is now reset through the registry in that build configuration. Statically-linked builds are unchanged.

See GHSA-v3ph-cgqh-r8p5.

frankenphp_reset_session_state() clears PS(id) between worker requests so a
session id cannot bleed across concurrent clients. That function is guarded by
HAVE_PHP_SESSION, defined only when the session extension is visible at
FrankenPHP compile time.

When PHP ships session as a shared or out-of-tree module, HAVE_PHP_SESSION is
undefined and the reset is compiled out. Session still works at runtime, but
PS(id) survives the request boundary. Since session_start() reads the request
cookie only when PS(id) is NULL, a worker reuses the previous request's id and
can hand one client another client's session id.

Fall back to resetting the session module through the module registry in that
build configuration so the per-request cleanup always runs.

Fixes GHSA-v3ph-cgqh-r8p5
Copilot AI review requested due to automatic review settings July 18, 2026 13:41

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

@dunglas
dunglas merged commit be24d82 into main Jul 18, 2026
70 of 75 checks passed
@dunglas
dunglas deleted the fix/ghsa-v3ph-cgqh-r8p5-session-bleed branch July 18, 2026 13:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants