{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/react/http-1.0.0-1.11.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:reactphp:http:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-104827"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["react/http (1.0.0-1.11.0)"],"_cs_severities":["low"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["ReactPHP"],"content_html":"\u003cp\u003eThe react/http library, specifically within the \u003ccode\u003eClientRequestStream\u003c/code\u003e component, fails to impose a size limit on incoming HTTP response headers. The \u003ccode\u003ehandleData()\u003c/code\u003e method appends every incoming byte directly to an internal buffer without checking length, searching only for the \u003ccode\u003e\\r\\n\\r\\n\u003c/code\u003e or \u003ccode\u003e\\n\\n\u003c/code\u003e header terminator. An attacker hosting a malicious HTTP endpoint can stream an arbitrary amount of data to a client using the library, withholding the terminator and causing the client's memory consumption to grow monotonically until the PHP \u003ccode\u003ememory_limit\u003c/code\u003e is reached. This results in the crashing of the process or the entire event loop. The vulnerability affects all versions of \u003ccode\u003ereact/http\u003c/code\u003e from 1.0.0 through 1.11.0. This issue is remotely exploitable without authentication, including cases where a client is directed to a malicious URL via an HTTP redirect, making it a significant risk for applications that perform arbitrary external requests.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows for a remotely triggerable, unauthenticated denial of service against any application that uses the \u003ccode\u003ereact/http\u003c/code\u003e \u003ccode\u003eBrowser\u003c/code\u003e class to fetch data from untrusted sources. Successful exploitation causes the application process to crash due to memory exhaustion, leading to a loss of service availability for the affected process or worker. No confidentiality or integrity impact occurs, but the service disruption is total for the victim process.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the \u003ccode\u003ereact/http\u003c/code\u003e package to a version beyond 1.11.0 that implements the necessary header size constraints.\u003c/li\u003e\n\u003cli\u003eAudit applications utilizing \u003ccode\u003ereact/http\u003c/code\u003e to identify endpoints that perform outbound requests to potentially untrusted or attacker-controlled domains.\u003c/li\u003e\n\u003cli\u003eImplement egress filtering or network-level timeouts for outbound requests to mitigate the impact of long-lived, slow-header-streaming connections.\u003c/li\u003e\n\u003cli\u003eDeploy the patches for CVE-2026-104827 across all environments where \u003ccode\u003ereact/http\u003c/code\u003e is used as a client-side component.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-15T22:27:19Z","date_published":"2026-10-15T22:27:19Z","id":"https://feed.craftedsignal.io/briefs/2026-10-react-http-dos/","summary":"The react/http library is vulnerable to a memory exhaustion Denial of Service (DoS) due to the lack of size constraints on incoming HTTP response headers (CVE-2026-104827).","title":"Unbounded HTTP Response Header Buffering in react/http","url":"https://feed.craftedsignal.io/briefs/2026-10-react-http-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - React/Http (1.0.0-1.11.0)","version":"https://jsonfeed.org/version/1.1"}