CVE-2026-104827: React/HTTP DoS Vulnerability

CVE-2026-104827 Overview

CVE-2026-104827 is a denial-of-service vulnerability in react/http, the event-driven streaming HTTP client and server implementation for ReactPHP. The flaw affects versions 1.0.0 through 1.11.0. The React\Http\Browser client appends inbound response-header bytes to an internal buffer via ClientRequestStream::handleData() without enforcing a size limit. A hostile or compromised upstream server can send a valid status line and partial headers, omit the \r\n\r\n terminator, and stream data indefinitely. The buffer grows until the PHP memory_limit is reached, crashing the event loop or worker. The issue is categorized under [CWE-770] Allocation of Resources Without Limits or Throttling and is fixed in version 1.11.1.

Critical Impact
Applications fetching attacker-controlled URLs — including URLs reached through HTTP redirects — can be forced to exhaust process memory, crashing long-running ReactPHP workers and halting request processing.

Affected Products

reactphp/http versions 1.0.0 through 1.11.0
Applications using React\Http\Browser to fetch remote URLs
ReactPHP-based workers, daemons, and services issuing outbound HTTP requests

Discovery Timeline

2026-10-15 - CVE-2026-104827 published to NVD
2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-104827

Vulnerability Analysis

The React\Http\Browser client parses HTTP responses incrementally as bytes arrive over the socket. The ClientRequestStream::handleData() method accumulates incoming bytes in an internal string buffer until it detects the header terminator sequence \r\n\r\n (or \n\n). Only after this terminator arrives does the client finalize header parsing and transition into body streaming.

Before the fix, no cap existed on how large that pre-terminator buffer could grow. A remote peer that sends a syntactically valid status line, begins emitting headers, and then withholds the terminator while continuing to send bytes keeps the parser in the header-accumulation state indefinitely. Each inbound chunk extends the buffer in PHP memory until the process reaches its configured memory_limit and aborts.

Confidentiality and integrity are not affected. The impact is restricted to availability of the ReactPHP process.

Root Cause

The root cause is missing input bounds enforcement in the HTTP response header parser. ClientRequestStream concatenated streamed bytes into $this->buffer without comparing its length against any maximum. The patch introduces a private $maxHeaderSize = 65536; property that bounds the pre-terminator header region. This maps directly to [CWE-770] Allocation of Resources Without Limits or Throttling.

Attack Vector

The attack requires the victim application to issue an outbound HTTP request to a URL the attacker controls or influences. Common exploitation paths include server-side URL fetchers, webhook callers, link previewers, OAuth or OIDC relying parties, and any workflow that follows HTTP redirects to attacker-chosen hosts. The attacker's server returns a seemingly valid response start, then streams data without ever closing the header section.

php

// Patch excerpt from src/Io/ClientRequestStream.php
     const STATE_HEAD_WRITTEN = 2;
     const STATE_END = 3;
 
+    private $maxHeaderSize = 65536;
+
     /** @var ClientConnectionManager */
     private $connectionManager;
// Source: https://github.com/reactphp/http/commit/2558622d0b76227c60c61eac8a61572cb6638e8c

The added maxHeaderSize constant caps the header-accumulation buffer at 64 KB, after which the client aborts the connection instead of continuing to allocate memory.

Detection Methods for CVE-2026-104827

Indicators of Compromise

PHP worker processes terminating with Allowed memory size of X bytes exhausted errors tied to ClientRequestStream::handleData() frames in the stack trace.
Repeated outbound TCP connections to a single remote host that remain open for extended durations without completing a response.
Spikes in resident memory on ReactPHP workers correlated with outbound HTTP activity to untrusted or user-supplied URLs.

Detection Strategies

Inventory applications that depend on reactphp/http at versions below 1.11.1 using Composer lockfile scans or software composition analysis.
Instrument HTTP client wrappers to log response-header size and time-to-first-byte for every outbound request.
Alert when outbound HTTP requests exceed a reasonable header-parse duration (for example, more than a few seconds without reaching the body).

Monitoring Recommendations

Track per-process memory growth on ReactPHP workers and correlate crashes with outbound request logs.
Monitor PHP error logs for memory_limit fatals originating from ReactPHP I/O classes.
Rate-limit and whitelist outbound destinations for any component that fetches user-supplied URLs or follows redirects.

How to Mitigate CVE-2026-104827

Immediate Actions Required

Upgrade reactphp/http to version 1.11.1 or later across all services, workers, and dependent libraries.
Audit code paths that call React\Http\Browser with attacker-influenced URLs, including redirect chains, SSRF-adjacent fetchers, and webhook consumers.
Restart long-running ReactPHP worker processes after the upgrade to clear any in-flight vulnerable instances.

Patch Information

The fix is published in GitHub Release v1.11.1 and implemented in commit 2558622d. Technical background is available in the GitHub Security Advisory GHSA-g4f2-2pf3-2pwj. The patch adds a $maxHeaderSize cap of 65536 bytes to ClientRequestStream, aborting connections that exceed the limit before the header terminator is received.

Workarounds

Restrict outbound HTTP destinations to an allowlist of trusted hosts, blocking arbitrary user-supplied URLs.
Disable automatic redirect following for React\Http\Browser instances that reach untrusted upstreams.
Enforce a conservative PHP memory_limit and process supervisor restart policy to contain availability impact until patching completes.

bash

# Upgrade reactphp/http to the patched release
composer require reactphp/http:^1.11.1
composer update reactphp/http --with-dependencies

# Verify installed version
composer show reactphp/http | grep versions