Event-driven HTTP Client and Server Vulnerability in ReactPHP

CVE-2026-84997

What is CVE-2026-84997?

A vulnerability exists in the ReactPHP library for handling HTTP requests and responses, where the ChunkedDecoder can become unresponsive in scenarios involving malformed 'Transfer-Encoding: chunked' bodies. This happens when the buffer state is improperly handled, which can allow malicious clients to freeze the server or potentially cause clients to become unresponsive. The issue has been resolved in version 1.11.1. A protective measure could involve using a reverse proxy to normalize incoming requests, though this may not safeguard against outbound request issues.

References