https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Fri, 18 Sep 2026 21:28:19 +0000 https://vulnerability.circl.lu/sighting/260ce21c-fbb9-4540-b6d0-df2f7159f631/export {"uuid": "260ce21c-fbb9-4540-b6d0-df2f7159f631", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-84997", "type": "seen", "source": "https://gist.github.com/alon710/5bae97c112644e43c69dc3ea5005f105", "content": "# CVE-2026-84997: CVE-2026-84997: Infinite Loop Denial of Service in ReactPHP HTTP Component\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-09-17\n> **Full Report:** https://cvereports.com/reports/CVE-2026-84997\n\n## Summary\nAn infinite loop vulnerability in ReactPHP's react/http chunked transfer encoding decoder (v0.6.0 up to 1.11.1) allows unauthenticated remote attackers to trigger a denial of service (DoS) by sending crafted chunked requests or responses, completely freezing the single-threaded event loop and pegging CPU usage to 100%.\n\n## TL;DR\nA logical flaw in ReactPHP's chunked parser allows remote attackers to block the single-threaded event loop indefinitely using malformed chunked transfer encoding payloads, leading to a complete Denial of Service.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-835\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 7.5 (High)\n- **Exploit Status**: PoC available in test suite\n- **KEV Status**: Not Listed\n- **Impact**: Denial of Service (CPU exhaustion and event-loop freeze)\n\n## Affected Systems\n\n- ReactPHP HTTP Server (react/http)\n- ReactPHP HTTP Browser (react/http client)\n- Any server-side PHP framework or server layer that utilizes ReactPHP's stream handlers for Transfer-Encoding processing.\n- **react/http**: >= 0.6.0, < 1.11.1 (Fixed in: `1.11.1`)\n\n## Mitigation\n\n- Upgrade react/http package dependencies to 1.11.1 or newer.\n- Deploy upstream reverse proxies (Nginx, HAProxy) to normalize and validate HTTP request chunk boundaries before forwarding to ReactPHP.\n- Configure strict connection timeouts to enforce active stream termination.\n\n**Remediation Steps:**\n1. In the ReactPHP application directory, run 'composer require react/http:^1.11.1' to update the package dependency.\n2. Confirm the lockfile registers version 1.11.1 or greater.\n3. Deploy and configure an upstream reverse proxy like Nginx with standard request normalization enabled.\n4. Verify server operation using the non-disruptive integration test suites.\n\n## References\n\n- [GitHub Security Advisory (GHSA-x424-64qh-5j54)](https://github.com/reactphp/http/security/advisories/GHSA-x424-64qh-5j54)\n- [Core Parser Logic Fix Commit](https://github.com/reactphp/http/commit/b6d4688790adf3797071fcf88a3fc4225f30486a)\n- [Trailer Size Limit Commit](https://github.com/reactphp/http/commit/58bc906dcaa5d360830555360bfdeacff3be0260)\n- [Integration Merge Commit](https://github.com/reactphp/http/commit/c0865b4687da67bf01c59074a8896a93565f82bd)\n- [Release v1.11.1 Release Notes](https://github.com/reactphp/http/releases/tag/v1.11.1)\n- [Release Tag Commit](https://github.com/reactphp/http/commit/e5b8eb2654dec6cbbc692a39f05ea4ecd40c8cc1)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-84997) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-18T08:31:51.857853Z"} {"uuid": "260ce21c-fbb9-4540-b6d0-df2f7159f631", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-84997", "type": "seen", "source": "https://gist.github.com/alon710/5bae97c112644e43c69dc3ea5005f105", "content": "# CVE-2026-84997: CVE-2026-84997: Infinite Loop Denial of Service in ReactPHP HTTP Component\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-09-17\n> **Full Report:** https://cvereports.com/reports/CVE-2026-84997\n\n## Summary\nAn infinite loop vulnerability in ReactPHP's react/http chunked transfer encoding decoder (v0.6.0 up to 1.11.1) allows unauthenticated remote attackers to trigger a denial of service (DoS) by sending crafted chunked requests or responses, completely freezing the single-threaded event loop and pegging CPU usage to 100%.\n\n## TL;DR\nA logical flaw in ReactPHP's chunked parser allows remote attackers to block the single-threaded event loop indefinitely using malformed chunked transfer encoding payloads, leading to a complete Denial of Service.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-835\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 7.5 (High)\n- **Exploit Status**: PoC available in test suite\n- **KEV Status**: Not Listed\n- **Impact**: Denial of Service (CPU exhaustion and event-loop freeze)\n\n## Affected Systems\n\n- ReactPHP HTTP Server (react/http)\n- ReactPHP HTTP Browser (react/http client)\n- Any server-side PHP framework or server layer that utilizes ReactPHP's stream handlers for Transfer-Encoding processing.\n- **react/http**: >= 0.6.0, < 1.11.1 (Fixed in: `1.11.1`)\n\n## Mitigation\n\n- Upgrade react/http package dependencies to 1.11.1 or newer.\n- Deploy upstream reverse proxies (Nginx, HAProxy) to normalize and validate HTTP request chunk boundaries before forwarding to ReactPHP.\n- Configure strict connection timeouts to enforce active stream termination.\n\n**Remediation Steps:**\n1. In the ReactPHP application directory, run 'composer require react/http:^1.11.1' to update the package dependency.\n2. Confirm the lockfile registers version 1.11.1 or greater.\n3. Deploy and configure an upstream reverse proxy like Nginx with standard request normalization enabled.\n4. Verify server operation using the non-disruptive integration test suites.\n\n## References\n\n- [GitHub Security Advisory (GHSA-x424-64qh-5j54)](https://github.com/reactphp/http/security/advisories/GHSA-x424-64qh-5j54)\n- [Core Parser Logic Fix Commit](https://github.com/reactphp/http/commit/b6d4688790adf3797071fcf88a3fc4225f30486a)\n- [Trailer Size Limit Commit](https://github.com/reactphp/http/commit/58bc906dcaa5d360830555360bfdeacff3be0260)\n- [Integration Merge Commit](https://github.com/reactphp/http/commit/c0865b4687da67bf01c59074a8896a93565f82bd)\n- [Release v1.11.1 Release Notes](https://github.com/reactphp/http/releases/tag/v1.11.1)\n- [Release Tag Commit](https://github.com/reactphp/http/commit/e5b8eb2654dec6cbbc692a39f05ea4ecd40c8cc1)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-84997) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-18T08:31:51.857853Z"} https://vulnerability.circl.lu/sighting/260ce21c-fbb9-4540-b6d0-df2f7159f631/export Fri, 18 Sep 2026 08:31:51 +0000 https://vulnerability.circl.lu/sighting/0640b5fc-c9e9-47a5-ba68-d049450ebfd4/export {"uuid": "0640b5fc-c9e9-47a5-ba68-d049450ebfd4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-84997", "type": "published-proof-of-concept", "source": "https://github.com/reactphp/http/security/advisories/GHSA-x424-64qh-5j54", "content": "", "creation_timestamp": "2026-09-17T22:35:15.116896Z"} {"uuid": "0640b5fc-c9e9-47a5-ba68-d049450ebfd4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-84997", "type": "published-proof-of-concept", "source": "https://github.com/reactphp/http/security/advisories/GHSA-x424-64qh-5j54", "content": "", "creation_timestamp": "2026-09-17T22:35:15.116896Z"} https://vulnerability.circl.lu/sighting/0640b5fc-c9e9-47a5-ba68-d049450ebfd4/export Thu, 17 Sep 2026 22:35:15 +0000