CVE-2026-84997: 
PHP vulnerability analysis and mitigation

CVE-2026-84997 is a Denial-of-Service vulnerability in the react/http library for ReactPHP, caused by an infinite loop in React\Http\Io\ChunkedDecoder when processing malformed Transfer-Encoding: chunked HTTP bodies. It affects all versions from 0.6.0 through 1.11.0 and was disclosed on September 9, 2026, with a fix released the same day in version 1.11.1. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory).

The root cause is CWE-835 (Loop with Unreachable Exit Condition). The ChunkedDecoder::handleData() method loops while $this->buffer !== '' and assumes the buffer shrinks each iteration, but two edge cases prevent this. First, when processing a terminal chunk (chunkSize === 0) with an incomplete trailer lacking a CRLF, strpos() returns false, which PHP coerces to 0 in substr(), leaving the buffer unchanged and neither the error guard nor the wait guard able to fire. Second, exactly two non-CRLF bytes following a completed non-terminal chunk bypass both the error guard (strlen > 2) and the wait guard (strlen < 2), also leaving the buffer unchanged. The fix in commit b6d4688 adds an explicit return when $positionCrlf === false for the terminal-chunk case and changes the error guard condition from > 2 to >= 2 for the off-by-one case (GitHub Advisory, Fix Commit).

Successful exploitation causes the ReactPHP process to peg a CPU core at 100% and freeze the event loop indefinitely, rendering the server or client completely unresponsive to all subsequent requests until the process is manually killed. Because ReactPHP is single-threaded, a single malformed request is sufficient to deny service to all connected clients. Both React\Http\HttpServer (server direction, attackable by a malicious client) and React\Http\Browser (client direction, attackable by a malicious or compromised remote server) are affected, with no confidentiality or integrity impact (GitHub Advisory).

A proof-of-concept exploit payload is publicly documented in the GitHub Security Advisory and requires no authentication, no privileges, and no user interaction, making it fully automatable over the network. The exploit is a standalone denial-of-service with no chaining potential. As of the disclosure date, there is no evidence of active in-the-wild exploitation, and the EPSS score is 0.0. The vulnerability is not listed in the CISA KEV catalog (GitHub Advisory).

1. Reconnaissance: Identify services running ReactPHP react/http versions 0.6.0–1.11.0, typically exposed on ports 80, 8080, or other configured HTTP ports.
2. Craft malformed chunked request (terminal-chunk variant): Construct an HTTP POST request with Transfer-Encoding: chunked whose body contains a terminal chunk (0\r\n) followed by trailer bytes without a terminating CRLF, e.g.:

POST / HTTP/1.1\r\nHost: x\r\nTransfer-Encoding: chunked\r\n\r\n0\r\nab

(Note: the trailing \r\n after ab is intentionally omitted.) 3. Alternatively, craft off-by-one variant: Send a non-terminal chunk followed by exactly two non-CRLF bytes, e.g., body 1\r\nAAB, to trigger the second infinite-loop condition. 4. Send the request: Transmit the malformed request to the target ReactPHP HTTP server using any raw TCP client (e.g., nc, curl --data-binary, or a custom script). 5. Observe denial of service: The PHP process enters an infinite loop, pegging one CPU core at 100%. The event loop freezes and the server stops responding to all legitimate requests until the process is killed (GitHub Advisory).

• Network: Incoming HTTP POST (or other method) requests with Transfer-Encoding: chunked headers where the body terminates with 0\r\n followed by non-CRLF bytes and no final \r\n; requests with a chunk body of the form 1\r\nAAB (data chunk followed by exactly two non-CRLF bytes).
• Process: PHP process consuming a sustained 100% CPU on a single core with no corresponding increase in throughput; the ReactPHP process becomes unresponsive to new connections.
• Logs: Absence of new access log entries after a specific request timestamp, indicating the event loop has frozen; no error log output (the loop produces no exceptions or warnings).
• Availability: Monitoring alerts for HTTP service unavailability or health-check failures on the ReactPHP application port immediately following receipt of a malformed chunked request (GitHub Advisory).

Upgrade react/http to version 1.11.1 immediately, as this is the only complete fix for both affected code paths (Release v1.11.1). As a partial server-side workaround, deploying a reverse proxy (e.g., nginx) that parses and re-frames HTTP before forwarding to the ReactPHP application will normalize chunked bodies and protect the server direction; however, this does not protect React\Http\Browser client instances making outbound requests, which must be addressed by upgrading. Applications that use Browser to fetch attacker-influenced URLs are at particular risk and should be prioritized for patching (GitHub Advisory).

The vulnerability was reported by security researchers jsifuentes and raiFork, with the fix authored by jsifuentes and clue (the primary ReactPHP maintainer). The ReactPHP project released version 1.11.1 as an explicit security release and encouraged all users to upgrade immediately, noting it as a high-severity issue (Release v1.11.1). No significant broader media coverage or social media discussion has been identified beyond the official advisory.