CVE-2026-104827 in http
Summary
by MITRE • 10/15/2026
react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 1.0.0 until 1.11.1, React\Http\Browser uses ClientRequestStream::handleData() to append response-header bytes to an internal buffer without enforcing a size limit. A remote server can send a valid status line and partial header, withhold the \r\n\r\n or \n\n header terminator, and continue streaming data so the buffer grows for the life of the connection. Applications that fetch attacker-controlled or attacker-influenced URLs, including URLs reached through redirects, can exhaust PHP memory_limit and crash the event-loop or worker process. Confidentiality and integrity are unaffected. This issue is fixed in version 1.11.1.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified within ReactPHP's HTTP component represents a classic resource exhaustion flaw rooted in improper input validation and lack of boundary enforcement during network data processing. Specifically, the defect resides in the ClientRequestStream::handleData() method used by the React\Http\Browser class across versions 1.0.0 through 1.11.1. In standard HTTP protocol operations, a client receives a status line followed by header fields and concludes the headers with a specific delimiter sequence, typically carriage return and newline characters (\r\n\r\n or \n\n). The vulnerable implementation fails to enforce any maximum size limit on the internal buffer used to accumulate these response-header bytes. Consequently, if a remote server sends a valid initial status line and partial headers but deliberately omits the terminating header delimiter while continuing to stream additional data, the client library will continue appending this incoming payload to its memory buffer indefinitely for the duration of the connection. This behavior transforms what should be a finite parsing operation into an unbounded accumulation process that directly consumes available system resources without check or balance.
From an operational perspective, this flaw poses a significant risk to application stability and availability rather than data confidentiality or integrity. Applications utilizing ReactPHP to fetch URLs, particularly those where the target URL is attacker-controlled or influenced through mechanisms such as HTTP redirects, are susceptible to memory exhaustion attacks. As the internal buffer expands without limit due to the maliciously crafted response stream, it eventually consumes all available PHP memory_limit settings. This resource depletion leads to a fatal error within the PHP runtime environment, causing the event-loop or worker process handling the request to crash abruptly. Such crashes result in service unavailability for other concurrent requests handled by the same process and can lead to cascading failures if not properly isolated at the infrastructure level. The attack vector is remote and requires only that an attacker controls a server responding to HTTP requests from the vulnerable application, making it feasible for denial-of-service scenarios against web services relying on this library for outbound communication.
This vulnerability aligns with Common Weakness Enumeration (CWE) category CWE-789: Memory Allocation with Excessive Size or Unbounded Capacity, as well as CWE-400: Uncontrolled Resource Consumption. The exploitation technique mirrors patterns found in the MITRE ATT&CK framework under resource hijacking techniques, specifically those aimed at causing denial of service through application-level exhaustion rather than network-layer flooding. By leveraging legitimate HTTP protocol mechanics but abusing the lack of size constraints on header parsing buffers, an attacker can efficiently degrade system performance without requiring high bandwidth or complex payload structures. The impact is strictly limited to availability, as the attack does not involve injection of malicious code into memory for execution (code injection) nor does it expose sensitive data stored in the buffer beyond what was already transmitted by the server.
Mitigation strategies focus primarily on upgrading the affected library and implementing defensive coding practices within application logic. The most effective remediation is to upgrade React\Http to version 1.11.1 or later, where the developers have implemented proper size limits for header buffers to prevent unbounded growth. For applications unable to immediately update dependencies, mitigations include configuring PHP memory_limit settings with appropriate constraints relative to expected traffic loads and implementing timeout mechanisms on HTTP client connections to limit the duration of any single request interaction. Additionally, application-level validation should be applied to URLs before making requests, ensuring that redirects are monitored for loops or unexpected destinations controlled by third parties. Monitoring tools should also be deployed to detect abnormal memory usage patterns in worker processes, allowing for automated restarts or alerts when resource consumption exceeds defined thresholds, thereby containing the impact of potential exploitation attempts until a permanent fix is applied.