CVE-2026-84997 in http
Summary
by MITRE • 09/16/2026
react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 0.6.0 until 1.11.1, React\Http\Io\ChunkedDecoder could enter an infinite loop while processing a malformed Transfer-Encoding: chunked body because handleData required its buffer to shrink on every iteration. An incomplete terminal-chunk trailer without CRLF left the buffer unchanged after strpos returned false, and exactly two non-CRLF bytes after a completed non-terminal chunk bypassed both the error and wait guards. The affected decoder processes request bodies for React\Http\HttpServer and response bodies for React\Http\Browser, allowing a malicious client to freeze a server or a malicious or compromised server to freeze a client. A reverse proxy that normalizes inbound requests may protect the server direction but does not protect outbound Browser requests. This issue is fixed in version 1.11.1.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified in ReactPHP's HTTP component, specifically within versions ranging from 0.6.0 to 1.11.1, represents a critical resource exhaustion flaw rooted in the logic of the ChunkedDecoder class. This module is responsible for parsing HTTP messages that utilize chunked transfer encoding, a mechanism commonly used when the size of the payload is unknown prior transmission. The core technical failure occurs during the processing of malformed Transfer-Encoding headers where the decoder enters an infinite loop rather than terminating with an error or waiting for additional data as intended. This behavior stems from specific edge cases in how the buffer state is managed after parsing incomplete terminal chunks and non-terminal segments, leading to a denial-of-service condition that can freeze either server-side listeners or client-side browser instances depending on which side of the connection initiates the malformed traffic.
The technical mechanism behind this infinite loop involves two distinct failure modes within the handleData method. First, when processing an incomplete terminal-chunk trailer that lacks the required Carriage Return Line Feed (CRLF) sequence, the strpos function fails to locate the delimiter and returns false. In this scenario, the decoder logic incorrectly leaves the buffer unchanged instead of signaling a malformed message or waiting for more data, causing the loop condition to persist indefinitely because no progress is made in consuming input bytes. Second, a separate flaw allows exactly two non-CRLF bytes following a completed non-terminal chunk to bypass both error detection and wait guards. These specific byte sequences do not trigger the expected validation checks, allowing the decoder to continue processing without advancing past the problematic data points, thereby sustaining an infinite loop that consumes CPU resources indefinitely.
From an operational perspective, this vulnerability poses significant risks to availability for any system relying on ReactPHP's HTTP server or browser components. A malicious client can exploit the server-side implementation by sending crafted chunked bodies that trigger these specific malformed states, effectively freezing the event loop and rendering the application unresponsive to legitimate requests. Conversely, a compromised or malicious server can target clients using the React\Http\Browser component with similarly crafted responses, causing the client process to hang indefinitely. This bidirectional impact highlights the severity of the flaw as it affects both inbound request processing and outbound response handling, creating potential points of failure in microservices architectures that depend on asynchronous HTTP communication for inter-service connectivity or external API interactions.
Mitigation strategies must address both direct exposure and indirect propagation risks. The primary remediation is to upgrade ReactPHP/http to version 1.11.1 or later, where the logic governing buffer state transitions and chunk validation has been corrected to properly handle malformed inputs without entering infinite loops. For environments that cannot immediately patch all instances, deploying a reverse proxy such as Nginx or Apache in front of the PHP application can provide partial protection for server-side endpoints by normalizing inbound requests and rejecting invalid HTTP constructs before they reach the vulnerable ReactPHP codebase. However, this defensive measure does not protect outbound traffic initiated by the React\Http\Browser component, meaning client-side applications remain exposed to attacks from malicious servers unless those clients are also updated or isolated within a controlled network segment with strict egress filtering policies.
This vulnerability aligns with CWE-835, which describes loops that consume excessive resources leading to denial of service, and maps to the ATT&CK technique T1499, Endpoint Denial of Service, specifically under subcategories involving resource exhaustion via application layer protocols. The incident underscores the importance of rigorous input validation in event-driven architectures where a single malformed packet can halt an entire thread or process due to non-blocking I/O models that rely on timely state transitions. Security teams should prioritize patching this component across all affected services and consider implementing network-level monitoring for anomalous HTTP traffic patterns indicative of chunked encoding abuse, ensuring comprehensive coverage against both inbound exploitation attempts and outbound compromise scenarios.