CVE-2026-84997: ReactPHP HTTP denial of service in chunked decoder

CVE-2026-84997 · Severity: high · CVSS 7.5 · Published 2026-09-16

ReactPHP is a PHP library used to build asynchronous web applications and HTTP clients. A malformed HTTP request or response using chunked transfer encoding can cause the library to enter an infinite loop, consuming 100% CPU and freezing the entire application until it is forcibly restarted. This affects both HTTP servers (when handling client requests) and HTTP clients (when fetching remote URLs).

Technologies: react/http (Packagist). Vendors: Packagist.

Quick answers

Is CVE-2026-84997 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-84997 being exploited in the wild.
How severe is CVE-2026-84997?
High severity, with a CVSS score of 7.5, published 16 September 2026.
Which products and versions are affected?
react/http (Packagist) >= 0.6.0, <= 1.11.0, ECOSYSTEM:introduced=0.6.0,fixed=1.11.1.
Is there a fix for CVE-2026-84997?
Yes. react/http (Packagist): upgrade to 1.11.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-84997 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-84997?
Check whether you run react/http (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • react/http (Packagist): upgrade to 1.11.1 or later
    composer require react/http:^1.11.1

Technical details

The vulnerability is an infinite loop in `React\Http\Io\ChunkedDecoder::handleData()` triggered by malformed HTTP chunked transfer encoding. The decoder processes chunked bodies by looping while the buffer is non-empty, but two conditions can leave the buffer unchanged: (1) when a terminating 0-sized chunk is followed by trailer data without a CRLF, `substr()` receives `false` from `strpos()` which coerces to 0, leaving the buffer unchanged; (2) when exactly two non-CRLF bytes remain after a completed chunk, both the error guard (requiring `&gt;2` bytes) and wait guard (requiring `&lt;2` bytes) fail, causing the same state to re-process. A network attacker can send a crafted HTTP request or response containing `Transfer-Encoding: chunked` with malformed body structure (e.g., `0\r\nab` or `1\r\nAAB`). Since ReactPHP is single-threaded, the infinite loop blocks the event loop for all clients, causing complete denial of service. Applications using `React\Http\Browser` to fetch attacker-controlled URLs are affected even if behind a reverse proxy. Patch availability is not explicitly stated in the advisory.

Affected products

  • ReactPHP HTTP <unknown

Identifiers

  • CVE-2026-84997
  • GHSA-x424-64qh-5j54

Timeline

  • 2026-09-17: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.