CVE-2026-104827 Details
Description
react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 1.0.0 until 1.11.1, React\Http\Browser uses ClientRequestStream::handleData() to append response-header bytes to an internal buffer without enforcing a size limit. A remote server can send a valid status line and partial header, withhold the \r\n\r\n or \n\n header terminator, and continue streaming data so the buffer grows for the life of the connection. Applications that fetch attacker-controlled or attacker-influenced URLs, including URLs reached through redirects, can exhaust PHP memory_limit and crash the event-loop or worker process. Confidentiality and integrity are unaffected. This issue is fixed in version 1.11.1.
A denial-of-service vulnerability has been identified in the ReactPHP HTTP component, specifically in versions 1.0.0 prior to 1.11.1. The issue arises in the HTTP client when response headers are buffered without a size limit. This flaw allows a remote server to send a valid status line and partial headers, while withholding the header terminator, causing the buffer to grow indefinitely. As a result, applications that fetch URLs controlled or influenced by an attacker can exhaust the PHP memory limit, leading to a crash of the event loop or worker process. This vulnerability does not affect confidentiality or integrity.
Users are advised to upgrade to ReactPHP HTTP version 1.11.1, which addresses this vulnerability by enforcing a maximum header size limit.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 15, 2026CISA-ADP
Assessed Oct 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/reactphp/http/commit/2558622d0b76227c60c61eac8a61572cb6638e8c | [email protected] | Source CodeVendor |
| https://github.com/reactphp/http/releases/tag/v1.11.1 | [email protected] | Release NotesVendor |
| https://github.com/reactphp/http/security/advisories/GHSA-g4f2-2pf3-2pwj | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ReactPHP/react/http | >= 1.0.0, <= 1.11.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 16, 2026 | CVE Modified | CISA-ADP |
| Oct 15, 2026 | New CVE Received | [email protected] |