ReactPHP HTTP CVE-2026-104827

The victim application must use React\Http\Browser (ReactPHP http 1.0.0-1.11.0) to make outbound HTTP requests to a URL the attacker controls or can influence - this explicitly includes URLs reached through redirects, so a trusted initial host that redirects to an attacker host is sufficient. The attacker must control the responding server to send a valid status line plus partial headers while withholding the \r\n\r\n or \n\n terminator and continuing to stream bytes. Limiting factors: exploitation is impossible unless the application fetches attacker-influenced URLs (apps that only call fixed trusted endpoints are not exposed); impact is confined to availability (process/worker crash via PHP memory_limit exhaustion) with no confidentiality or integrity effect; and upgrading to 1.11.1, which enforces a 65536-byte response-header cap, fully mitigates it.

All signals align on this being a genuine but bounded availability-only risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H = 7.5) is consistent with the description: a remote, unauthenticated, low-complexity attack with high availability impact and zero confidentiality/integrity impact (CWE-770, uncontrolled resource consumption). The key nuance the raw score hides is that the victim application must act as an HTTP client via React\Http\Browser and must be induced to fetch an attacker-controlled or attacker-influenced URL - so PR:N/UI:N is technically accurate from the attacker's perspective, but exploitation depends on an application-side design condition (fetching untrusted URLs, including through redirects). No EPSS score was provided and the vulnerability is not listed in CISA KEV, indicating no evidence of active exploitation. No standalone public exploit was supplied; the only exploitation evidence is the vendor's own regression test embedded in the fix commit, which demonstrates the overflow but is not a weaponized POC. Net: a real, patch-worthy DoS for services that make outbound HTTP calls to untrusted endpoints, but not a drop-everything priority - there is no RCE/data-exposure path and no indication of in-the-wild use.

An application uses React\Http\Browser to fetch a URL the attacker can influence (e.g. a webhook target, link-preview fetcher, or SSRF-reachable endpoint, including via HTTP redirects). The attacker's server returns a valid status line and partial headers but never sends the \r\n\r\n (or \n\n) terminator, instead streaming data indefinitely so ClientRequestStream's header buffer grows unbounded until the PHP memory_limit is hit and the event-loop/worker process crashes. No public weaponized exploit was identified at time of analysis, though the fix commit includes a regression test that reproduces the overflow condition.