Unbounded HTTP Client Response Header Buffering Leads to Memory Exhaustion DoS in react/http

PKSA-2zvc-7x4m-kphn

Affected version: >=1.0.0,<1.11.1

Reported by:
FriendsOfPHP/security-advisories

[HIGH] A malformed HTTP chunked body can lead to a denial-of-service and peg the CPU

PKSA-7xc4-r5ry-fg9s CVE-2026-84997 GHSA-x424-64qh-5j54

Affected version: >=0.6.0,<1.11.1

Reported by:
GitHub, FriendsOfPHP/security-advisories

[MEDIUM] ReactPHP's HTTP server continues parsing unused multipart parts after reaching limits

PKSA-wsbn-q9bd-w7z2 CVE-2023-26044 GHSA-95x4-j7vc-h8mf

Affected version: >=0.8.0,<1.9.0

Reported by:
GitHub, FriendsOfPHP/security-advisories