Executive brief
ReactPHP is a PHP library used to build asynchronous web applications and HTTP clients. A malformed HTTP request or response using chunked transfer encoding can cause the library to enter an infinite loop, consuming 100% CPU and freezing the entire application until it is forcibly restarted. This affects both HTTP servers (when handling client requests) and HTTP clients (when fetching remote URLs).
Technical details
The vulnerability is an infinite loop in `React\Http\Io\ChunkedDecoder::handleData()` triggered by malformed HTTP chunked transfer encoding. The decoder processes chunked bodies by looping while the buffer is non-empty, but two conditions can leave the buffer unchanged: (1) when a terminating 0-sized chunk is followed by trailer data without a CRLF, `substr()` receives `false` from `strpos()` which coerces to 0, leaving the buffer unchanged; (2) when exactly two non-CRLF bytes remain after a completed chunk, both the error guard (requiring `>2` bytes) and wait guard (requiring `<2` bytes) fail, causing the same state to re-process. A network attacker can send a crafted HTTP request or response containing `Transfer-Encoding: chunked` with malformed body structure (e.g., `0\r\nab` or `1\r\nAAB`). Since ReactPHP is single-threaded, the infinite loop blocks the event loop for all clients, causing complete denial of service. Applications using `React\Http\Browser` to fetch attacker-controlled URLs are affected even if behind a reverse proxy. Patch availability is not explicitly stated in the advisory.
Affected products
- ReactPHP HTTP <unknown
Timeline
- 2026-09-17: disclosed