Published 1.12.7 images ship frankenphp binary with several fixable CRITICAL/HIGH Go stdlib CVEs (go1.24.4)

[mohaelmrabet]

Summary

Docker Scout flagged several fixable CRITICAL/HIGH vulnerabilities in the Go standard library (go1.24.4) linked into the published frankenphp binary, on top of the ones already discussed in #2559.

CVE	Severity (CVSS)	Module	Fixable
CVE-2025-68121	10.0 CRITICAL	golang/stdlib go1.24.4	yes
CVE-2026-39821	9.6 CRITICAL	golang/stdlib go1.24.4	yes
CVE-2026-33818	7.5 HIGH	golang/stdlib go1.24.4	yes
CVE-2025-61726	7.5 HIGH	golang/stdlib go1.24.4	yes
CVE-2025-61725	7.5 HIGH	golang/stdlib go1.24.4	yes

Found scanning dunglas/frankenphp:1.12.7-php8.5 (via a downstream image built FROM it) with Docker Scout.

Reproduction

docker scout cves dunglas/frankenphp:1.12.7-php8.5 --only-severity critical,high --only-fixed

or with Trivy:

trivy image --scanners vuln --severity CRITICAL,HIGH --ignore-unfixed dunglas/frankenphp:1.12.7-php8.5

Request

Similar to #2559: a Go toolchain bump (or rebuild against a newer go1.24.x/go1.25.x) in the next release would resolve these. Not asking for a dedicated release — just flagging so they're picked up in the next routine build, since they weren't part of the module list discussed in #2559.

Happy to close as a duplicate/false-positive if these are already known to not affect FrankenPHP's actual usage of these stdlib packages, same as the #2559 outcome.

[mohaelmrabet]

Following up — same false-positive pattern as #2559 (kin-openapi/grpc)? These 5 are all golang/stdlib go1.24.4, flagged CRITICAL/HIGH but likely in stdlib code paths FrankenPHP/Caddy don't exercise (e.g. net/http server-side edge cases, archive/tar, etc. depending on the specific CVE). If so, happy to have this closed the same way, with a note that the Go toolchain will get bumped in a routine release like the others.

[mohaelmrabet]

Looks like this might already be resolved on `main` — go.mod was bumped from go1.24.4 to `go 1.27.0` on 2026-08-25 (18 days after the v1.12.7 release, which was still built with go1.24.4). If that's the case, this should just need the next release to pick it up — no action needed beyond that, feel free to close if the CVEs are indeed no longer present with the 1.27 toolchain.