http vulnerabilities

2 known vulnerabilities in http from Reactphp. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  http: Allocation of Resources Without Limits or Throttling

  CVE-2026-104827Oct 15, 2026Reactphp

  react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 1.0.0 until 1.11.1, React\Http\Browser uses ClientRequestStream::handleData() to append response-header bytes to an internal buffer without enforcing a size limit

• 7.5 High severity

  http: Loop with Unreachable Exit Condition

  CVE-2026-84997Sep 16, 2026Reactphp

  react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 0.6.0 until 1.11.1, React\Http\Io\ChunkedDecoder could enter an infinite loop while processing a malformed Transfer-Encoding: chunked body because handleData requ