CVE-2026-104827

Deferred Deferred - Pending Action

Memory Exhaustion in ReactPHP HTTP Client

Publication date: 2026-10-15

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description

react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 1.0.0 until 1.11.1, React\Http\Browser uses ClientRequestStream::handleData() to append response-header bytes to an internal buffer without enforcing a size limit. A remote server can send a valid status line and partial header, withhold the \r\n\r\n or \n\n header terminator, and continue streaming data so the buffer grows for the life of the connection. Applications that fetch attacker-controlled or attacker-influenced URLs, including URLs reached through redirects, can exhaust PHP memory_limit and crash the event-loop or worker process. Confidentiality and integrity are unaffected. This issue is fixed in version 1.11.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-16

EPSS Evaluated

2026-10-18

NVD

CVE-2026-104827

EUVD

EUVD-2026-102255

Affected Vendors & Products

Vendor	Product	Version / Range
reactphp	http	>= 1.0.0, < 1.11.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

This vulnerability affects the react/http library versions 1.0.0 to 1.11.0. It involves an unbounded HTTP client response header buffering issue where the ClientRequestStream::handleData() method appends every incoming byte to an internal buffer without checking its length. A malicious server can withhold the header terminator and continuously send data, causing the client's memory to grow indefinitely until PHP's memory limit is exceeded and the process crashes.

Detection Guidance

To detect this vulnerability, monitor for unusually high memory usage in PHP processes handling HTTP requests. Check for processes stuck in an infinite loop or crashing due to memory exhaustion when fetching URLs. Use tools like `top`, `htop`, or `ps` to observe memory consumption of PHP workers. Logs may show `OverflowException` errors if the patched version is installed.

Impact Analysis

Applications using react/http to fetch attacker-controlled or attacker-influenced URLs, including redirects, can crash due to memory exhaustion. This leads to denial-of-service conditions where the event-loop or worker process becomes unavailable. Confidentiality and integrity of data are not affected.

Compliance Impact

This vulnerability primarily impacts availability by enabling denial-of-service (DoS) attacks through memory exhaustion. It does not directly affect confidentiality or integrity of data. Compliance with standards like GDPR or HIPAA is indirectly impacted if the DoS disrupts systems handling personal or health data, potentially leading to service unavailability and associated risks.

Mitigation Strategies

Immediately upgrade react/http to version 1.11.1 or later. If upgrading is not possible, restrict access to URLs fetched by the application or implement a timeout for HTTP client requests. Monitor network traffic for suspicious patterns, such as servers withholding header terminators.

Hi! I’m here to help you understand CVE-2026-104827. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70