Linux Distros Unpatched Vulnerability : CVE-2026-104827

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 1.0.0 until 1.11.1, React\Http\Browser uses...

Denial-of-service (DoS)

React\Http is vulnerable to a denial-of-service DoS. The vulnerability is due to the lack of a size limit on the response-header buffer, which allows a remote attacker to exhaust PHP memory and crash the application by continuously sending HTTP response data without terminating the headers...

UBUNTU-CVE-2026-104827

react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 1.0.0 until 1.11.1, React\Http\Browser uses ClientRequestStream::handleData to append response-header bytes to an internal buffer without enforcing a size limit. A remote server can send a valid stat...

GHSA-G4F2-2PF3-2PWJ react/http: Unbounded HTTP Client Response Header Buffering Leads to Memory Exhaustion DoS

Summary React\Http\Browser and its lower-level HTTP stack impose no limit on the size of a response's header section while it is being received. ClientRequestStream::handleData appends every incoming byte to an internal buffer and only scans that buffer for the \r\n\r\n or \n\n terminator, withou...

react/http: Unbounded HTTP Client Response Header Buffering Leads to Memory Exhaustion DoS

Summary React\Http\Browser and its lower-level HTTP stack impose no limit on the size of a response's header section while it is being received. ClientRequestStream::handleData appends every incoming byte to an internal buffer and only scans that buffer for the \r\n\r\n or \n\n terminator, withou...

CVE-2026-104827

react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 1.0.0 until 1.11.1, React\Http\Browser uses ClientRequestStream::handleData to append response-header bytes to an internal buffer without enforcing a size limit. A remote server can send a valid stat...

CVE-2026-104827

react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 1.0.0 until 1.11.1, React\Http\Browser uses ClientRequestStream::handleData to append response-header bytes to an internal buffer without enforcing a size limit. A remote server can send a valid stat...

CVE-2026-104827 react/http: Unbounded HTTP Client Response Header Buffering Leads to Memory Exhaustion DoS

react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 1.0.0 until 1.11.1, React\Http\Browser uses ClientRequestStream::handleData to append response-header bytes to an internal buffer without enforcing a size limit. A remote server can send a valid stat...

CVE-2026-104827

react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 1.0.0 until 1.11.1, React\Http\Browser uses ClientRequestStream::handleData to append response-header bytes to an internal buffer without enforcing a size limit. A remote server can send a valid stat...

CVE-2026-104827

The react/http library (an event-driven HTTP client and server for ReactPHP ) is vulnerable to a memory exhaustion Denial of Service (DoS) in versions 1.0.0 through 1.11.1 . The root cause lies in React\Http\Browser 's ClientRequestStream::handleData() function, which appends response-header byte...

CVE-2026-104827 react/http: Unbounded HTTP Client Response Header Buffering Leads to Memory Exhaustion DoS

react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 1.0.0 until 1.11.1, React\Http\Browser uses ClientRequestStream::handleData to append response-header bytes to an internal buffer without enforcing a size limit. A remote server can send a valid stat...

PT-2026-115093

Name of the Vulnerable Software and Affected Versions react/http versions 1.0.0 through 1.11.0 Description ReactHttpBrowser fails to enforce a size limit on the internal buffer used to store response-header bytes. When the handleData function in ClientRequestStream receives data, it appends...

CVE-2026-104827: Allocation of Resources Without Limits or Throttling

react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 1.0.0 until 1.11.1, React\Http\Browser uses ClientRequestStream::handleData to append response-header bytes to an internal buffer without enforcing a size limit. A remote server can send a valid stat...

ReactPHP react/http DoS

The vulnerability of the handleData function in the ReactPHP library’s react/http package, which handles streaming HTTP messages, is related to the execution of a loop with an unreachable exit condition. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

EUVD-2026-80779

react/http: A malformed HTTP chunked body can lead to a denial-of-service and peg the CPU...

Infinite loop

Overview Affected versions of this package are vulnerable to Infinite loop via the ChunkedDecoder::handleData process. An attacker can cause the process to enter an infinite loop and exhaust CPU resources by sending a malformed HTTP message with Transfer-Encoding: chunked that exploits specific...

GHSA-X424-64QH-5J54 react/http: A malformed HTTP chunked body can lead to a denial-of-service and peg the CPU

Summary A malformed HTTP message using Transfer-Encoding: chunked can drive React\Http\Io\ChunkedDecoder into an infinite loop, pegging a CPU core and freezing the event loop. Because ReactPHP is single-threaded, one such message stalls the entire process for every client until it is killed. Both...

react/http: A malformed HTTP chunked body can lead to a denial-of-service and peg the CPU

Summary A malformed HTTP message using Transfer-Encoding: chunked can drive React\Http\Io\ChunkedDecoder into an infinite loop, pegging a CPU core and freezing the event loop. Because ReactPHP is single-threaded, one such message stalls the entire process for every client until it is killed. Both...

CVE-2026-84997

react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 0.6.0 until 1.11.1, React\Http\Io\ChunkedDecoder could enter an infinite loop while processing a malformed Transfer-Encoding: chunked body because handleData required its buffer to shrink on every...

CVE-2026-84997 react/http: A malformed HTTP chunked body can lead to a denial-of-service and peg the CPU

react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 0.6.0 until 1.11.1, React\Http\Io\ChunkedDecoder could enter an infinite loop while processing a malformed Transfer-Encoding: chunked body because handleData required its buffer to shrink on every...