reactphp CVE debriefs

CVE-2026-104827

A memory exhaustion denial-of-service vulnerability exists in `react/http` due to unbounded buffering of HTTP response headers. This issue allows a remote attacker to cause a PHP process crash by streaming large headers without a terminator. The vulnerability is caused by the `ClientRequestStream::handleData()` method appending incoming bytes to an internal buffer without checking its length. This can lea [truncated]