react/http: A malformed HTTP chunked body can lead to a denial-of-service and peg the CPU

• >= 0.6.0, <= 1.11.0

### Summary A malformed HTTP message using `Transfer-Encoding: chunked` can drive `React\Http\Io\ChunkedDecoder` into an infinite loop, pegging a CPU core and freezing the event loop. Because ReactPHP is single-threaded, one such message stalls the entire process for every client until it is killed. Both directions are affected. `ChunkedDecoder` decodes chunked **request** bodies for `React\Http\HttpServer` and chunked **response** bodies for `React\Http\Browser`, so a server can be attacked by a malicious client and a client can be attacked by a malicious or compromised server. ### Details `ChunkedDecoder::handleData()` loops `while ($this->buffer !== '')` and relies on the buffer shrinking each iteration. Two states leave the buffer unchanged while the loop condition stays true. **Terminal-chunk trailer.** After the terminating `0` chunk, any remaining buffer is treated as trailer data to skip: ```php } elseif ($this->chunkSize === 0) { $this->buffer = (string)\substr($this->buffer, $positionCrlf); } ``` When the trailer holds no CRLF yet, `strpos()` returns `false`, PHP coerces that to `0` in `substr()`, and the buffer is never advanced. Neither the error guard (which

GitHub Advisory Database

• ECOSYSTEM: introduced 0.6.0; fixed 1.11.1

### Summary A malformed HTTP message using `Transfer-Encoding: chunked` can drive `React\Http\Io\ChunkedDecoder` into an infinite loop, pegging a CPU core and freezing the event loop. Because ReactPHP is single-threaded, one such message stalls the entire process for every client until it is killed. Both directions are affected. `ChunkedDecoder` decodes chunked **request** bodies for `React\Http\HttpServer` and chunked **response** bodies for `React\Http\Browser`, so a server can be attacked by a malicious client and a client can be attacked by a malicious or compromised server. ### Details `ChunkedDecoder::handleData()` loops `while ($this->buffer !== '')` and relies on the buffer shrinking each iteration. Two states leave the buffer unchanged while the loop condition stays true. **Terminal-chunk trailer.** After the terminating `0` chunk, any remaining buffer is treated as trailer data to skip: ```php } elseif ($this->chunkSize === 0) { $this->buffer = (string)\substr($this->buffer, $positionCrlf); } ``` When the trailer holds no CRLF yet, `strpos()` returns `false`, PHP coerces that to `0` in `substr()`, and the buffer is never advanced. Neither the error guard (which

GitHub Advisory Database via OSV