CVE-2026-84997: Infinite Loop Denial of Service in ReactPHP HTTP Component
Vulnerability ID: CVE-2026-84997
CVSS Score: 7.5
Published: 2026-09-17
An infinite loop vulnerability in ReactPHP's react/http chunked transfer encoding decoder (v0.6.0 up to 1.11.1) allows unauthenticated remote attackers to trigger a denial of service (DoS) by sending crafted chunked requests or responses, completely freezing the single-threaded event loop and pegging CPU usage to 100%.
TL;DR
A logical flaw in ReactPHP's chunked parser allows remote attackers to block the single-threaded event loop indefinitely using malformed chunked transfer encoding payloads, leading to a complete Denial of Service.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-835
- Attack Vector: Network (AV:N)
- CVSS v3.1 Score: 7.5 (High)
- Exploit Status: PoC available in test suite
- KEV Status: Not Listed
- Impact: Denial of Service (CPU exhaustion and event-loop freeze)
Affected Systems
- ReactPHP HTTP Server (react/http)
- ReactPHP HTTP Browser (react/http client)
- Any server-side PHP framework or server layer that utilizes ReactPHP's stream handlers for Transfer-Encoding processing.
-
react/http: >= 0.6.0, < 1.11.1 (Fixed in:
1.11.1)
Code Analysis
Commit: b6d4688
fix cases where a malformed HTTP request with 'Transfer-Encoding: chunked' could lead to ReactPHP looping forever
Commit: 58bc906
Limit ChunkedDecoder trailer size to avoid unbounded buffering
Commit: c0865b4
Merge branch 'clue/fix-chunked-decoder-loop' into 1.x
Commit: e5b8eb2
Prepare v1.11.1 release tag
Exploit Details
- GitHub Security Advisory Integration Suite: Reproduction test suites built into the repository to validate scenarios involving incomplete trailers and 2-byte off-by-one errors.
Mitigation Strategies
- Upgrade react/http package dependencies to 1.11.1 or newer.
- Deploy upstream reverse proxies (Nginx, HAProxy) to normalize and validate HTTP request chunk boundaries before forwarding to ReactPHP.
- Configure strict connection timeouts to enforce active stream termination.
Remediation Steps:
- In the ReactPHP application directory, run 'composer require react/http:^1.11.1' to update the package dependency.
- Confirm the lockfile registers version 1.11.1 or greater.
- Deploy and configure an upstream reverse proxy like Nginx with standard request normalization enabled.
- Verify server operation using the non-disruptive integration test suites.
References
- GitHub Security Advisory (GHSA-x424-64qh-5j54)
- Core Parser Logic Fix Commit
- Trailer Size Limit Commit
- Integration Merge Commit
- Release v1.11.1 Release Notes
- Release Tag Commit
Read the full report for CVE-2026-84997 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)