CVE-2026-104827

### Summary `React\Http\Browser` and its lower-level HTTP stack impose no limit on the size of a response's header section while it is being received. `ClientRequestStream::handleData()` appends every incoming byte to an internal buffer and only scans that buffer for the `\r\n\r\n` (or `\n\n`) terminator, without ever checking its length. A remote server that withholds the terminator and keeps streaming can grow the client's memory without bound until PHP's `memory_limit` is exhausted and the process crashes. This is an unauthenticated, network-reachable denial of service against any application that uses `react/http` as a client to fetch untrusted or attacker-influenced URLs, including via redirects. ### Details `ClientRequestStream::handleData()` is bound directly to the underlying connection's `data` event, so every byte the peer sends is appended with no size check: ```php public function handleData($data) { $this->buffer .= $data; // buffer until double CRLF (or double LF for compatibility with legacy servers) $eom = \strpos($this->buffer, "\r\n\r\n"); $eomLegacy = \strpos($this->buffer, "\n\n"); if ($eom !== false || $eomLegacy !== false) { ``` The only exit from the buffering state is finding the header terminator or a connection close, so until it arrives the buffer grows monotonically for as long as the peer keeps sending. The codebase already applies this class of limit elsewhere, but not symmetrically. `RequestHeaderParser` caps incoming **request** headers when acting as a server, and `Transaction::bufferResponse()` caps the response **body**, but only once the header section has already been parsed into a `Response`. Response header reception was the one stage with no limit at all. ### PoC An HTTP server that sends a valid status line and a partial header, then streams indefinitely without ever terminating the header section: ```bash php -r '$s=stream_socket_server("tcp://127.0.0.1:18080"); $c=stream_socket_accept($s); fre