Skip to content
OpenAdvisories

Vendor

reactphp

4 known vulnerabilities.

Products

http 4
All Critical High Medium Low Exploited only

2 results · Clear filters · Feed

  • High 7.5
    CVE-2026-104827

    react/http: Unbounded HTTP Client Response Header Buffering Leads to Memory Exhaustion DoS

    react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 1.0.0 until 1.11.1, React\Http\Browser uses ClientRequestStream::handleData() to append response-header bytes to an internal buffer without enforcing a size limi…

    reactphp http react/http php-react-http Ubuntu Packagist
  • High 7.5
    CVE-2026-84997

    react/http: A malformed HTTP chunked body can lead to a denial-of-service and peg the CPU

    react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 0.6.0 until 1.11.1, React\Http\Io\ChunkedDecoder could enter an infinite loop while processing a malformed Transfer-Encoding: chunked body because handleData req…

    reactphp http react/http Packagist