TI-2026-74656 Aliases CVE-2026-104827 GHSA-g4f2-2pf3-2pwj

Unbounded header buffering in ReactPHP HTTP client exhausts memory

LOW 39CWE-770Published 2026-10-15 · Updated 2026-10-16

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-770.

Summary

react/http, the event-driven HTTP client and server for ReactPHP, is affected from 1.0.0 before 1.11.1. React\Http\Browser appends response header bytes to an internal buffer without a size limit (CWE-770). A remote server can send a valid status line and a partial header, withhold the header terminator, and keep streaming data so the buffer grows for the life of the connection. An attacker who can make an application fetch attacker-controlled URLs, including URLs reached through redirects, can exhaust PHP memory_limit and crash the event-loop or worker process, while confidentiality and integrity are unaffected.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 1.0.0 until 1.11.1, React\Http\Browser uses ClientRequestStream::handleData() to append response-header bytes to an internal buffer without enforcing a size limit. A remote server can send a valid status line and partial header, withhold the \r\n\r\n or \n\n header terminator, and continue streaming data so the buffer grows for the life of the connection. Applications that fetch attacker-controlled or attacker-influenced URLs, including URLs reached through redirects, can exhaust PHP memory_limit and crash the event-loop or worker process. Confidentiality and integrity are unaffected. This issue is fixed in version 1.11.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00517 44th percentileScored 2026-11-07

Fix Fixed http (reactphp): 1.11.1react/http (Packagist): 1.11.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
reactphp	http	1.0.0 to before 1.11.1	1.11.1	Patch available	CNA
—	react/http (Packagist)	1.0.0 to before 1.11.1	1.11.1	Patch available	GHSA-g4f2-2pf3-2pwj

http Vendorreactphp Affected 1.0.0 to before 1.11.1 Fixed in 1.11.1 Patch available CNA
react/http (Packagist) Vendor— Affected 1.0.0 to before 1.11.1 Fixed in 1.11.1 Patch available GHSA-g4f2-2pf3-2pwj

Remediation

Upgrade react/http to version 1.11.1 or later, which fixes the issue on Packagist. The sources list no fixed version for reactphp http.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Fix · CNA http (reactphp) Fixed in 1.11.1
Fix · GHSA-g4f2-2pf3-2pwj react/http (Packagist) Fixed in 1.11.1 Advisory →

Timeline

2026-10-16 Threatist record created from CVE-2026-104827
2026-10-16 Alias added: GHSA-g4f2-2pf3-2pwj
2026-10-16 Priority changed: MEDIUM → LOW
2026-10-16 CISA SSVC decision points changed

References

Other 4

TI-2026-58400 react/http: A malformed HTTP chunked body can lead to a denial-of-service and peg the CPU CVSS 3.1HIGH 7.5
TI-2022-16457 ReactPHP's HTTP server parses encoded cookie names so malicious `__Host-` and `__Secure-` cookies can be sent CVSS 3.1MEDIUM 5.3
TI-2023-11278 ReactPHP's HTTP server continues parsing unused multipart parts after reaching limits CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences