Vulnerability · Published Oct 15, 2026 · Assigned by GitHub_M

CVE-2026-104827react/http: Unbounded HTTP Client Response Header Buffering Leads to Memory Exhaustion DoS

High 7.5

In plain English

A high-severity resource allocation without limits in http from reactphp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.5%top 55.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 1.0.0 until 1.11.1, React\Http\Browser uses ClientRequestStream::handleData() to append response-header bytes to an internal buffer without enforcing a size limit. A remote server can send a valid status line and partial header, withhold the \r\n\r\n or \n\n header terminator, and continue streaming data so the buffer grows for the life of the connection. Applications that fetch attacker-controlled or attacker-influenced URLs, including URLs reached through redirects, can exhaust PHP memory_limit and crash the event-loop or worker process. Confidentiality and integrity are unaffected. This issue is fixed in version 1.11.1.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	react/http	1.11.1	GHSA-g4f2-2pf3-2pwj

Affected products (as reported)

Vendor	Product	Versions
reactphp	http	>= 1.0.0, < 1.11.1

Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://github.com/reactphp/http/security/advisories/GHSA-g4f2-2pf3-2pwj x_refsource_CONFIRM
https://github.com/reactphp/http/commit/2558622d0b76227c60c61eac8a61572cb6638e8c x_refsource_MISC
https://github.com/reactphp/http/releases/tag/v1.11.1 x_refsource_MISC