CyberSecBulletin

Reactphp vulnerabilities

We track 2 vulnerabilities in Reactphp products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on October 15, 2026.

2vulnerabilities
0critical
2high
0exploited
7.5average CVSS score

Latest Reactphp vulnerabilities

  • 7.5 High severity

    http: Allocation of Resources Without Limits or Throttling

    CVE-2026-104827Reactphp

    react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 1.0.0 until 1.11.1, React\Http\Browser uses ClientRequestStream::handleData() to append response-header bytes to an internal buffer without enforcing a size limit

  • 7.5 High severity

    http: Loop with Unreachable Exit Condition

    CVE-2026-84997Reactphp

    react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 0.6.0 until 1.11.1, React\Http\Io\ChunkedDecoder could enter an infinite loop while processing a malformed Transfer-Encoding: chunked body because handleData requ