Denial of Service via Malformed HTTP Chunked Encoding in react/http

The ReactPHP react/http package (versions 0.6.0 through 1.11.0) contains a vulnerability in the ChunkedDecoder::handleData() method. The decoder enters an infinite loop when processing specific malformed HTTP chunked bodies, leading to a denial-of-service condition. Because ReactPHP utilizes a single-threaded event loop, this infinite loop pegs a CPU core and halts all other event processing, effectively freezing the application.

The vulnerability manifests in two primary scenarios:

1. Terminal-chunk trailers where strpos() fails to locate a CRLF, causing the buffer to never advance.
2. Off-by-one errors after a completed chunk where two bytes slip past existing guards, causing the loop to re-enter with identical state.

The vulnerability impacts both the HttpServer (server-side, exploitable by malicious clients) and the Browser component (client-side, exploitable by malicious servers). Servers protected by a reverse proxy that normalizes HTTP traffic may mitigate the server-side vector, but client-side applications fetching attacker-influenced URLs remain fully exposed.

Attack Chain

1. Attacker identifies a target application utilizing react/http (versions >= 0.6.0, <= 1.11.0).
2. For server-side attacks, the attacker crafts a malicious HTTP request with Transfer-Encoding: chunked.
3. Attacker includes a terminating 0 chunk followed by trailer data without a trailing \r\n sequence.
4. The request is passed to the HttpServer component and subsequently the ChunkedDecoder.
5. ChunkedDecoder::handleData() enters an infinite while loop due to the buffer state never advancing.
6. The process hits 100% CPU usage on a single core, stalling the event loop.
7. The application stops responding to all other legitimate client requests.
8. Service availability is lost until the process is manually killed or restarted.

Impact

Successful exploitation results in a full denial of service for the target application. Since ReactPHP is single-threaded, a single malicious request freezes the entire event loop, preventing the processing of legitimate traffic. This impacts any PHP application relying on these components for HTTP handling, including services acting as clients (Browser) that perform external fetches.

Recommendation

1. Update react/http to a version beyond 1.11.0.
2. If an immediate update is not feasible, implement a reverse proxy (e.g., nginx) in front of HttpServer to normalize incoming HTTP traffic and filter non-compliant chunked payloads.
3. Review all client-side logic using React\Http\Browser to ensure that responses from external services are validated or that the fetching service is isolated from core application processing.
4. Implement resource monitoring to alert on persistent 100% CPU spikes in PHP-based HTTP services.