Selectively unbounded buffering of HTTP response headers allows an attacker to keep a connection open while sending a large amount of header data. The header bytes are appended to an internal buffer without a size limit, so a remote server can send a status line followed by a partial header, then delay the final delimiter, forcing the buffer to grow. Once the PHP memory_limit is exceeded, the event loop or worker process crashes, denying service. No data is leaked and integrity is not compromised, but availability is fully impacted.

The CVE affects the ReactPHP library react/http, specifically the Browser component (ClientRequestStream::handleData) in releases from 1.0.0 through 1.11.1. The vulnerability is fixed in v1.11.1. Applications that use these versions to fetch URLs from potentially untrusted or redirect‑based sources are exposed.

The CVSS score of 7.5 implies a high severity. The EPSS score of less than 1% indicates that exploitation probability is currently very low, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote HTTP clients sending maliciously crafted responses; the attacker must control or influence a server that the application connects to and maintain a persistent TCP connection for the buffer to grow. The impact is local to the affected PHP process and results in a Denial‑of‑Service rather than data compromise. Because the vulnerability is fixable by upgrading the dependency, the risk can be mitigated with a timely patch.