Symfony version(s) affected

5.4.9

Description

We are using the Symfony HttpClient component as a stand alone component. Our PHP version is 7.4.3. We have the CURL extension installed and I checked that we are in fact using the CurlHttpClient.

After updating to the newest 5.4 release (5.4.9) we noticed that TCP ports are not closed anymore. We inspected the issue with netstat -anp. Normally after the request the ports should go into the state "TIME_WAIT" and be closed (removed from the netstat output) after a short time. Instead they stay in the state "ESTABLISHED", go to "CLOSE_WAIT" after a short time and never are closed. So when running our application in production after some time there are no ports free for new requests anymore.

Strangly this behaviour only appears when using the HttpClient in a method of a class. If the HttpClient is directly used in a script (e.g. the index.php file) everything works as expected.

Also the behaviour only appears in PHP 7.4 not in PHP 8.1. Not all version of the HttpClient are effected. Until 5.3.13 everythings works as expected. 5.3.14 was the first version where we experienced the bug. I looked on the diff between 5.3.13 and 5.3.14 but could not find a change that would trigger that weird bug. symfony/http-client@v5.3.13...v5.3.14

One last note: this bug only appears in PHP-FPM. PHP-CLI is not affected.

How to reproduce

Setup a PHP 7.4 system with the CURL extension enabled. Install version 5.4.9 of the HttpClient with Composer. Create an index.php file with the following content and open it in a web browser. Then use the netstat -anp command to get the status of the TCP ports.

<?php

require_once 'vendor/autoload.php';

class Foo
{
    public function bar(): string
    {
        $client = Symfony\Component\HttpClient\HttpClient::create();

        $response = $client->request(
            'GET',
            'https://swapi.dev/api/people/1'
        );

        return $response->getContent();
    }
}

$foo = new Foo();

echo $foo->bar();

Strangly the following code does not trigger the described bug.

<?php

require_once 'vendor/autoload.php';

$client = Symfony\Component\HttpClient\HttpClient::create();

$response = $client->request(
    'GET',
    'https://swapi.dev/api/people/1'
);

echo $response->getContent();

Possible Solution

No response

Additional Context

No response