Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-104827— react/http: Unbounded HTTP Client Response Header Buffering Leads to Memory Exhaustion DoS

Quick assessment

Affected
reactphp http
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

react/http 是 ReactPHP 的事件驱动型流式 HTTP 客户端和服务器实现。从版本 1.0.0 到 1.11.1，React\Http\Browser 使用 ClientRequestStream::handleData() 方法将响应头部字节追加到内部缓冲区中，但未对缓冲区大小施加限制。远程服务器可以发送一个有效的状态行和部分头部内容，不发送（或延迟发送）头部终止符 \r\n\r\n 或 \n\n，并持续流式传输数据，导致该缓冲区在连接存续期间不断膨胀。如果应用程序请求由攻击者控制或影响的 URL

CVSS 7.5 · High

Possible ATT&CK Techniques 1 AI

T1496 · Resource Hijacking

Affected Version Matrix 1

VendorProduct Version RangeStatus
reactphp http >= 1.0.0, < 1.11.1 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-104827

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
react/http: Unbounded HTTP Client Response Header Buffering Leads to Memory Exhaustion DoS
Source: CVE Program / CVE List V5
Vulnerability Description
react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 1.0.0 until 1.11.1, React\Http\Browser uses ClientRequestStream::handleData() to append response-header bytes to an internal buffer without enforcing a size limit. A remote server can send a valid status line and partial header, withhold the \r\n\r\n or \n\n header terminator, and continue streaming data so the buffer grows for the life of the connection. Applications that fetch attacker-controlled or attacker-influenced URLs, including URLs reached through redirects, can exhaust PHP memory_limit and crash the event-loop or worker process. Confidentiality and integrity are unaffected. This issue is fixed in version 1.11.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
不加限制或调节的资源分配
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
reactphp http >= 1.0.0, < 1.11.1 -

II. Public POCs for CVE-2026-104827

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-104827

请登录查看更多情报信息。

Vendor Pages for CVE-2026-104827 (1)

Other References for CVE-2026-104827 (2)

IV. Related Vulnerabilities

Same product: http
Same vendor: reactphp
Same weakness: CWE-770

V. Comments for CVE-2026-104827

No comments yet

Leave a comment