CVE-2023-26044

react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. Previous versions of ReactPHP's HTTP server component contain a potential DoS vulnerability that can cause high CPU load when processing large HTTP request bodies. This vulnerability has little to no impact on the default configuration, but can be exploited when explicitly using the RequestBodyBufferMiddleware with very large settings. This might lead to consuming large amounts of CPU time for processing requests and significantly delay or slow down the processing of legitimate user requests. This issue has been addressed in release 1.9.0. Users are advised to upgrade. Users unable to upgrade may keep the request body limited using RequestBodyBufferMiddleware with a sensible value which should mitigate the issue. An infrastructure or DevOps workaround could be to place a reverse proxy in front of the ReactPHP HTTP server to filter out any excessive HTTP request bodies.

• CWE-400

• https://github.com/reactphp/http/commit/9681f764b80c45ebfb5fe2ea7da5bd3babfcdcfdPatch
• https://github.com/reactphp/http/security/advisories/GHSA-95x4-j7vc-h8mfVendor Advisory
• https://github.com/reactphp/http/commit/9681f764b80c45ebfb5fe2ea7da5bd3babfcdcfdPatch
• https://github.com/reactphp/http/security/advisories/GHSA-95x4-j7vc-h8mfVendor Advisory

Published

May 17, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-26039ZoneMinder is a free, open source Closed-circuit television …8.8
• CVE-2023-2604The Team Circle Image Slider With Lightbox plugin for WordPr…6.1
• CVE-2023-26040Discourse is an open-source discussion platform. Between ver…6.1
• CVE-2023-26041Nextcloud Talk is a fully on-premises audio/video and chat c…4.3
• CVE-2023-26042Part-DB is an open source inventory management system for yo…6.1
• CVE-2023-26043GeoNode is an open source platform that facilitates the crea…6.5
• CVE-2023-26045NodeBB is Node.js based forum software. Starting in version …9.8
• CVE-2023-26046teler-waf is a Go HTTP middleware that provides teler IDS fu…6.1
• CVE-2023-26047teler-waf is a Go HTTP middleware that provides teler IDS fu…6.1
• CVE-2023-26048Jetty is a java based web server and servlet engine. In affe…5.3
• CVE-2023-26049Jetty is a java based web server and servlet engine. Nonstan…5.3
• CVE-2023-2605The wpbrutalai WordPress plugin before 2.0.1 does not saniti…6.1