Skip to content
OpenAdvisories

Vendor

reactphp

4 known vulnerabilities.

Products

http 4
All Critical High Medium Low Exploited only

4 results · Feed

  • High 7.5
    CVE-2026-104827

    react/http: Unbounded HTTP Client Response Header Buffering Leads to Memory Exhaustion DoS

    react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 1.0.0 until 1.11.1, React\Http\Browser uses ClientRequestStream::handleData() to append response-header bytes to an internal buffer without enforcing a size limi…

    reactphp http react/http php-react-http Ubuntu Packagist
  • High 7.5
    CVE-2026-84997

    react/http: A malformed HTTP chunked body can lead to a denial-of-service and peg the CPU

    react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 0.6.0 until 1.11.1, React\Http\Io\ChunkedDecoder could enter an infinite loop while processing a malformed Transfer-Encoding: chunked body because handleData req…

    reactphp http react/http Packagist
  • Medium 5.3
    CVE-2023-26044

    ReactPHP's HTTP server continues parsing unused multipart parts after reaching limits

    react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. Previous versions of ReactPHP's HTTP server component contain a potential DoS vulnerability that can cause high CPU load when processing large HTTP request bodies. Th…

    reactphp http react/http php-react-http Ubuntu Packagist
  • Medium 5.3
    CVE-2022-36032

    ReactPHP's HTTP server parses encoded cookie names so malicious `__Host-` and `__Secure-` cookies can be sent

    ReactPHP HTTP is a streaming HTTP client and server implementation for ReactPHP. In ReactPHP's HTTP server component versions starting with 0.7.0 and prior to 1.7.0, when ReactPHP is processing incoming HTTP cookie values, the cookie names are url-decoded. Th…

    reactphp http react/http icingaweb2-module-reactbundle Ubuntu Packagist