CVE-2026-84997: falha de alta gravidade em reactphp http
react/http: A malformed HTTP chunked body can lead to a denial-of-service and peg the CPU
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.5epss 0.7%
react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 0.6.0 until 1.11.1, React\Http\Io\ChunkedDecoder could enter an infinite loop while processing a malformed Transfer-Encoding: chunked body because handleData required its buffer to shrink on every iteration. An incomplete terminal-chunk trailer without CRLF left the buffer unchanged after strpos returned false, and exactly two non-CRLF bytes after a completed non-terminal chunk bypassed both the error and wait guards. The affected decoder processes request bodies for React\Http\HttpServer and response bodies for React\Http\Browser, allowing a malicious client to freeze a server or a malicious or compromised server to freeze a client. A reverse proxy that normalizes inbound requests may protect the server direction but does not protect outbound Browser requests. This issue is fixed in version 1.11.1.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
reactphp · httpCVEs relacionadas — reactphp http
No mesmo produto, das mais perigosas para as menos.
CVE-2022-36032MEDIUMReactPHP's HTTP server parses encoded cookie names so malicious `__Host-` and `__Secure-` cookies can be sentEPSS 1.2%CVE-2023-26044MEDIUMReactPHP's HTTP server continues parsing unused multipart parts after reaching limitsEPSS 0.7%CVE-2026-104827HIGHreact/http: Unbounded HTTP Client Response Header Buffering Leads to Memory Exhaustion DoSEPSS 0.5%