CVE-2026-104827: 
PHP vulnerability analysis and mitigation

CVE-2026-104827 is an unbounded HTTP client response header buffering vulnerability in the react/http library (ReactPHP) that allows a remote server to exhaust PHP process memory, causing a denial of service. It affects all versions from 1.0.0 through 1.11.0 of the reactphp/http Composer package. The vulnerability was reported on September 9, 2026, published to the GitHub Advisory Database on October 15, 2026, and assigned GHSA-g4f2-2pf3-2pwj. It carries a CVSS v3.1 base score of 7.5 (High) (Github Advisory, Feedly).

The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling) in ClientRequestStream::handleData(), which appends every incoming byte from a server response to an internal PHP string buffer without enforcing any maximum size. The method only exits the buffering state upon detecting the \r\n\r\n or \n\n header terminator, or a connection close — meaning a peer that withholds the terminator and continuously streams data causes the buffer to grow monotonically for the life of the connection. Notably, the codebase already enforces limits elsewhere: RequestHeaderParser caps incoming request headers (server mode) and Transaction::bufferResponse() caps response bodies, but response header reception had no limit at all. The fix in commit 2558622 introduces a $maxHeaderSize = 65536 (64 KB) constant and rejects responses exceeding this threshold with an OverflowException (Github Advisory, Patch Commit).

Successful exploitation results in complete availability loss for the affected PHP process: memory grows until PHP's memory_limit is exhausted, crashing the event loop or worker process. Any application using React\Http\Browser to fetch attacker-controlled, compromised, or attacker-influenced URLs — including those reached through HTTP redirects — is at risk. Confidentiality and integrity are entirely unaffected; the impact is limited to denial of service of the targeted process (Github Advisory).

No public proof-of-concept exploit code has been observed in the wild, and there is no evidence of active exploitation at this time. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. However, exploitation requires no authentication, no user interaction, and no special privileges — a single TCP connection to a malicious server is sufficient to trigger the condition, making it trivially exploitable for any application fetching untrusted URLs (Github Advisory, Feedly).

1. Set up a malicious HTTP server: Deploy a server that accepts TCP connections and responds with a valid HTTP status line and a partial header value, then streams data indefinitely without ever sending the \r\n\r\n header terminator. Example using PHP:

php -r '$s=stream_socket_server("tcp://0.0.0.0:18080"); $c=stream_socket_accept($s); fread($c,8192); fwrite($c,"HTTP/1.1 200 OK\r\nX-Fill: "); while (true) { fwrite($c, str_repeat("A",1048576)); usleep(10000); }'

2. Identify a vulnerable target: Find an application using reactphp/http versions 1.0.0–1.11.0 that fetches user-supplied or externally influenced URLs (e.g., webhook processors, URL preview services, proxy applications).
3. Trigger the fetch: Cause the target application to make an HTTP request to the attacker-controlled server — either directly by supplying the URL as input, or indirectly by placing the malicious server URL behind a redirect chain that the application follows.
4. Memory exhaustion: The vulnerable ClientRequestStream::handleData() method continuously appends incoming bytes to its internal buffer. With no size limit enforced, PHP memory grows until memory_limit is exhausted, crashing the event loop or worker process and causing a denial of service (Github Advisory).

• Process: PHP worker or event-loop process terminating with a fatal error message containing Allowed memory size of ... bytes exhausted inside ClientRequestStream::handleData().
• Logs: Application error logs showing repeated OverflowException or PHP fatal memory exhaustion errors originating from the react/http library stack trace (on unpatched versions, the process dies rather than throwing).
• Network: Long-lived outbound TCP connections from the PHP application server to an external host on port 80/443 (or other HTTP ports) that transfer large volumes of data without completing an HTTP response (no \r\n\r\n observed in the stream).
• System: Sudden worker process restarts or event-loop crashes correlated with outbound HTTP client requests to specific external endpoints; elevated memory usage trending upward on the PHP process before crash (Github Advisory).

Upgrade react/http to version 1.11.1 or later, which enforces a 64 KB maximum response header size and rejects oversized responses with an OverflowException (Release v1.11.1, Patch Commit). As a workaround if immediate patching is not possible, restrict the URLs that the application is permitted to fetch to a known-trusted allowlist, preventing requests to attacker-controlled endpoints. Additionally, consider implementing connection timeouts at the network or application level to limit the duration of any single outbound HTTP connection.

The vulnerability was reported by EQSTLab and fixed by WyriHaximus (Cees-Jan Kiewiet), a core ReactPHP maintainer, with analyst support from contributor 232-323. The fix was released as part of v1.11.1, which the ReactPHP project described as a security release encouraging all users to upgrade immediately. No significant broader media coverage or notable social media discussion has been identified beyond the official advisory (Github Advisory, Release v1.11.1).