Packagist/react/http CVE-2026-104827: high 7.5
react/http: Unbounded HTTP Client Response Header Buffering Leads to Memory Exhaustion DoS
Action: Upgrade react/http to 1.11.1 or later.
composer require react/http:1.11.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.0.0 | 1.11.1 | - |
Fixed versions
| 1.11.1 |
Sources
- osv: GHSA-g4f2-2pf3-2pwj
- https://github.com/reactphp/http/security/advisories/GHSA-g4f2-2pf3-2pwj
- https://github.com/reactphp/http/commit/2558622d0b76227c60c61eac8a61572cb6638e8c
- https://github.com/reactphp/http
- https://github.com/reactphp/http/releases/tag/v1.11.1
CVE-2026-104827 · published · modified · JSON