Linux Distros Unpatched Vulnerability : CVE-2026-104827

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 1.0.0 until 1.11.1, React\Http\Browser uses...

UBUNTU-CVE-2026-104827

react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 1.0.0 until 1.11.1, React\Http\Browser uses ClientRequestStream::handleData to append response-header bytes to an internal buffer without enforcing a size limit. A remote server can send a valid stat...

GHSA-G4F2-2PF3-2PWJ react/http: Unbounded HTTP Client Response Header Buffering Leads to Memory Exhaustion DoS

Summary React\Http\Browser and its lower-level HTTP stack impose no limit on the size of a response's header section while it is being received. ClientRequestStream::handleData appends every incoming byte to an internal buffer and only scans that buffer for the \r\n\r\n or \n\n terminator, withou...

react/http: Unbounded HTTP Client Response Header Buffering Leads to Memory Exhaustion DoS

Summary React\Http\Browser and its lower-level HTTP stack impose no limit on the size of a response's header section while it is being received. ClientRequestStream::handleData appends every incoming byte to an internal buffer and only scans that buffer for the \r\n\r\n or \n\n terminator, withou...

CVE-2026-104827

react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 1.0.0 until 1.11.1, React\Http\Browser uses ClientRequestStream::handleData to append response-header bytes to an internal buffer without enforcing a size limit. A remote server can send a valid stat...

CVE-2026-104827

react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 1.0.0 until 1.11.1, React\Http\Browser uses ClientRequestStream::handleData to append response-header bytes to an internal buffer without enforcing a size limit. A remote server can send a valid stat...

CVE-2026-104827

react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 1.0.0 until 1.11.1, React\Http\Browser uses ClientRequestStream::handleData to append response-header bytes to an internal buffer without enforcing a size limit. A remote server can send a valid stat...

CVE-2026-104827 react/http: Unbounded HTTP Client Response Header Buffering Leads to Memory Exhaustion DoS

react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 1.0.0 until 1.11.1, React\Http\Browser uses ClientRequestStream::handleData to append response-header bytes to an internal buffer without enforcing a size limit. A remote server can send a valid stat...

CVE-2026-104827

The react/http library (an event-driven HTTP client and server for ReactPHP ) is vulnerable to a memory exhaustion Denial of Service (DoS) in versions 1.0.0 through 1.11.1 . The root cause lies in React\Http\Browser 's ClientRequestStream::handleData() function, which appends response-header byte...

CVE-2026-104827 react/http: Unbounded HTTP Client Response Header Buffering Leads to Memory Exhaustion DoS

react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 1.0.0 until 1.11.1, React\Http\Browser uses ClientRequestStream::handleData to append response-header bytes to an internal buffer without enforcing a size limit. A remote server can send a valid stat...

EUVD-2026-102255

react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 1.0.0 until 1.11.1, React\Http\Browser uses ClientRequestStream::handleData to append response-header bytes to an internal buffer without enforcing a size limit. A remote server can send a valid stat...

CVE-2026-104827 react/http: Unbounded HTTP Client Response Header Buffering Leads to Memory Exhaustion DoS

react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 1.0.0 until 1.11.1, React\Http\Browser uses ClientRequestStream::handleData to append response-header bytes to an internal buffer without enforcing a size limit. A remote server can send a valid stat...

PT-2026-115093

Name of the Vulnerable Software and Affected Versions react/http versions 1.0.0 through 1.11.0 Description ReactHttpBrowser fails to enforce a size limit on the internal buffer used to store response-header bytes. When the handleData function in ClientRequestStream receives data, it appends...

CVE-2026-104827: Allocation of Resources Without Limits or Throttling

react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 1.0.0 until 1.11.1, React\Http\Browser uses ClientRequestStream::handleData to append response-header bytes to an internal buffer without enforcing a size limit. A remote server can send a valid stat...

ReactPHP HTTP resource management error vulnerabilities

The ReactPHP HTTP version 1.0.0 to 1.11.1 have a resource management vulnerability. This vulnerability arises from ClientRequestStream::handleData, which allows the response headers to be appended to the internal buffer without any size restrictions. A remote server can exploit this vulnerability...