{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/reactphp/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:reactphp:http:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-84997"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["react/http (\u003e= 0.6.0, \u003c= 1.11.0)"],"_cs_severities":["low"],"_cs_tags":["denial-of-service","php","vulnerability"],"_cs_type":"advisory","_cs_vendors":["ReactPHP"],"content_html":"\u003cp\u003eThe ReactPHP \u003ccode\u003ereact/http\u003c/code\u003e package (versions 0.6.0 through 1.11.0) contains a vulnerability in the \u003ccode\u003eChunkedDecoder::handleData()\u003c/code\u003e method. The decoder enters an infinite loop when processing specific malformed HTTP chunked bodies, leading to a denial-of-service condition. Because ReactPHP utilizes a single-threaded event loop, this infinite loop pegs a CPU core and halts all other event processing, effectively freezing the application.\u003c/p\u003e\n\u003cp\u003eThe vulnerability manifests in two primary scenarios:\u003c/p\u003e\n\u003col\u003e\n\u003cli\u003eTerminal-chunk trailers where \u003ccode\u003estrpos()\u003c/code\u003e fails to locate a CRLF, causing the buffer to never advance.\u003c/li\u003e\n\u003cli\u003eOff-by-one errors after a completed chunk where two bytes slip past existing guards, causing the loop to re-enter with identical state.\u003c/li\u003e\n\u003c/ol\u003e\n\u003cp\u003eThe vulnerability impacts both the \u003ccode\u003eHttpServer\u003c/code\u003e (server-side, exploitable by malicious clients) and the \u003ccode\u003eBrowser\u003c/code\u003e component (client-side, exploitable by malicious servers). Servers protected by a reverse proxy that normalizes HTTP traffic may mitigate the server-side vector, but client-side applications fetching attacker-influenced URLs remain fully exposed.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a target application utilizing \u003ccode\u003ereact/http\u003c/code\u003e (versions \u0026gt;= 0.6.0, \u0026lt;= 1.11.0).\u003c/li\u003e\n\u003cli\u003eFor server-side attacks, the attacker crafts a malicious HTTP request with \u003ccode\u003eTransfer-Encoding: chunked\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eAttacker includes a terminating \u003ccode\u003e0\u003c/code\u003e chunk followed by trailer data without a trailing \u003ccode\u003e\\r\\n\u003c/code\u003e sequence.\u003c/li\u003e\n\u003cli\u003eThe request is passed to the \u003ccode\u003eHttpServer\u003c/code\u003e component and subsequently the \u003ccode\u003eChunkedDecoder\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eChunkedDecoder::handleData()\u003c/code\u003e enters an infinite \u003ccode\u003ewhile\u003c/code\u003e loop due to the buffer state never advancing.\u003c/li\u003e\n\u003cli\u003eThe process hits 100% CPU usage on a single core, stalling the event loop.\u003c/li\u003e\n\u003cli\u003eThe application stops responding to all other legitimate client requests.\u003c/li\u003e\n\u003cli\u003eService availability is lost until the process is manually killed or restarted.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in a full denial of service for the target application. Since ReactPHP is single-threaded, a single malicious request freezes the entire event loop, preventing the processing of legitimate traffic. This impacts any PHP application relying on these components for HTTP handling, including services acting as clients (Browser) that perform external fetches.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpdate \u003ccode\u003ereact/http\u003c/code\u003e to a version beyond 1.11.0.\u003c/li\u003e\n\u003cli\u003eIf an immediate update is not feasible, implement a reverse proxy (e.g., nginx) in front of \u003ccode\u003eHttpServer\u003c/code\u003e to normalize incoming HTTP traffic and filter non-compliant chunked payloads.\u003c/li\u003e\n\u003cli\u003eReview all client-side logic using \u003ccode\u003eReact\\Http\\Browser\u003c/code\u003e to ensure that responses from external services are validated or that the fetching service is isolated from core application processing.\u003c/li\u003e\n\u003cli\u003eImplement resource monitoring to alert on persistent 100% CPU spikes in PHP-based HTTP services.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-09-18T01:11:26Z","date_published":"2026-09-18T01:11:26Z","id":"https://feed.craftedsignal.io/briefs/2026-09-react-http-dos/","summary":"A malformed HTTP chunked body triggers an infinite loop in the react/http ChunkedDecoder, causing 100% CPU usage and service disruption in both server and client implementations.","title":"Denial of Service via Malformed HTTP Chunked Encoding in react/http","url":"https://feed.craftedsignal.io/briefs/2026-09-react-http-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - ReactPHP","version":"https://jsonfeed.org/version/1.1"}