CVE-2026-104827 reactphp CVE debrief

Who should care

Defenders responsible for applications using `react/http` to fetch untrusted or attacker-influenced URLs should assess exposure and prioritize updates to version 1.11.1 or later. This includes operators, platform administrators, vulnerability management teams, and security teams who need to review and remediate affected systems. They should also monitor for large HTTP response headers and review compensating controls for exposed systems while remediation

Why it matters

This vulnerability allows a remote attacker to cause a denial of service against applications using `react/http` to fetch untrusted URLs. Defenders should prioritize updates to version 1.11.1 or later and assess exposure.

• Memory exhaustion leading to process crashes
• Denial of service against applications using `react/http`
• Potential for unauthenticated, network-reachable attacks
• Need for verification of affected versions and remediation

Technical summary

The `react/http` library does not impose a limit on the size of an HTTP response's header section while it is being received. This can cause a denial-of-service vulnerability when a remote server streams large headers without a terminator. The `ClientRequestStream::handleData()` method appends incoming bytes to an internal buffer without checking its length, leading to memory exhaustion and a process crash when the `memory_limit` is reached. Defenders should prioritize updating to version 1.11.1 or later and assess exposure in applications using `react/http` to fetch untrusted URLs.

Defensive priority

Defenders should prioritize updating to version 1.11.1 or later and assess exposure in applications using `react/http` to fetch untrusted URLs.

Recommended defensive actions

• Update to version 1.11.1 or later
• Assess exposure in applications using `react/http` to fetch untrusted URLs
• Monitor for large HTTP response headers
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by the `ClientRequestStream::handleData()` method appending incoming bytes to an internal buffer without checking its length. This can lead to memory exhaustion and a process crash when the `memory_limit` is reached.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.