CVE-2026-104827

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-104827
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-104827.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-104827
Aliases
Published
2026-10-15T18:19:32Z
Modified
2026-10-16T02:47:27Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
react/http: Unbounded HTTP Client Response Header Buffering Leads to Memory Exhaustion DoS
Details

react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 1.0.0 until 1.11.1, React\Http\Browser uses ClientRequestStream::handleData() to append response-header bytes to an internal buffer without enforcing a size limit. A remote server can send a valid status line and partial header, withhold the \r\n\r\n or \n\n header terminator, and continue streaming data so the buffer grows for the life of the connection. Applications that fetch attacker-controlled or attacker-influenced URLs, including URLs reached through redirects, can exhaust PHP memory_limit and crash the event-loop or worker process. Confidentiality and integrity are unaffected. This issue is fixed in version 1.11.1.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-770"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-104827.json"
}
References

Affected packages

Git / github.com/reactphp/http

Affected ranges

Type
GIT
Repo
https://github.com/reactphp/http
Events
Introduced
865694453c95122f8972b9ed7961efb3c517fc5e
Fixed
e5b8eb2654dec6cbbc692a39f05ea4ecd40c8cc1
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "1.0.0"
        },
        {
            "fixed":  "1.11.1"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

v1.*
v1.0.0
v1.1.0
v1.10.0
v1.11.0
v1.2.0
v1.3.0
v1.4.0
v1.5.0
v1.6.0
v1.7.0
v1.8.0
v1.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-104827.json"