{"items":[{"id":"CVE-2026-104827","published":"2026-10-15T18:19:32.785Z","updated":"2026-10-16T17:11:59.859Z","title":"react/http: Unbounded HTTP Client Response Header Buffering Leads to Memory Exhaustion DoS","severity":"HIGH","score":7.5,"vendor":"reactphp","product":"http","kev":false,"epss":0.00517,"kevAdded":null},{"id":"CVE-2026-84997","published":"2026-09-16T14:07:52.948Z","updated":"2026-09-16T14:46:47.220Z","title":"react/http: A malformed HTTP chunked body can lead to a denial-of-service and peg the CPU","severity":"HIGH","score":7.5,"vendor":"reactphp","product":"http","kev":false,"epss":0.00655,"kevAdded":null},{"id":"CVE-2023-26044","published":"2023-05-17T17:24:25.855Z","updated":"2025-01-23T19:52:01.375Z","title":"ReactPHP's HTTP server continues parsing unused multipart parts after reaching limits","severity":"MEDIUM","score":5.3,"vendor":"reactphp","product":"http","kev":false,"epss":0.0068,"kevAdded":null},{"id":"CVE-2022-36032","published":"2022-09-06T18:20:13.000Z","updated":"2025-04-23T17:14:48.031Z","title":"ReactPHP's HTTP server parses encoded cookie names so malicious `__Host-` and `__Secure-` cookies can be sent","severity":"MEDIUM","score":5.3,"vendor":"reactphp","product":"http","kev":false,"epss":0.01206,"kevAdded":null}]}