Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 0.6.0 until 1.11.1, React\Http\Io\ChunkedDecoder could enter an infinite loop while processing a malformed Transfer-Encoding: chunked body because handleData required its buffer to shrink on every iteration. An incomplete terminal-chunk trailer without CRLF left the buffer unchanged after strpos returned false, and exactly two non-CRLF bytes after a completed non-terminal chunk bypassed both the error and wait guards. The affected decoder processes request bodies for React\Http\HttpServer and response bodies for React\Http\Browser, allowing a malicious client to freeze a server or a malicious or compromised server to freeze a client. A reverse proxy that normalizes inbound requests may protect the server direction but does not protect outbound Browser requests. This issue is fixed in version 1.11.1.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-09-18 | 1 | Disclosure1 |
| 2026-09-30 | 1 | Patch1 |
#CVE-2026-84997 (CVSS 7.5) affects ReactPHP http 0.6.0-1.11.0. Malformed chunked encoding triggers infinite loop, enabling DoS against servers/clients. Patch to 1.11.1 immediately. #PatchNow #Vulnerability https://t.co/sQNq9Rsx9x
Post summary
The tweet discloses CVE-2026-84997 in ReactPHP http client, detailing a DoS vulnerability caused by malformed chunked encoding, and explicitly urges users to patch immediately to version 1.11.1.
🔴 ReactPHP HTTP ChunkedDecoder, Denial of Service, #CVE-2026-84997 (Critical) -DC-Sep2026-2470 https://dailycve.com/reactphp-http-chunkeddecoder-denial-of-service-cve-2026-84997-critical-dc-sep2026-2470/
Post summary
The tweet announces a critical Denial of Service vulnerability (CVE-2026-84997) in ReactPHP HTTP ChunkedDecoder, linking to a detailed article for further information.