CVE-2026-48979 Details
Description
PHP Standard Library (PSL) is set of APIs covering async, collections, networking, I/O, cryptography, terminal UI, etc. In versions 6.1.0, 6.1.1 and 6.2.0, the Psl\H2\ServerConnection does not validate that the total bytes received in DATA frames match the content-length header declared in the HEADERS frame, allowing request smuggling. This is in violation of RFC 9113 §8.1.1. A malicious client is able to send more DATA bytes than declared, smuggling additional content past application-level size limits and send fewer DATA bytes than declared and close the stream early, causing applications that trust the declared length to behave incorrectly. The vulnerability is only reachable for consumers using Psl\H2\ServerConnection directly to accept untrusted client traffic. Consumers of documented high-level PSL APIs are not affected. This issue has been fixed in versions 6.1.2 and 6.2.1.
A request smuggling vulnerability has been identified in the PHP Standard Library (PSL) versions 6.1.0, 6.1.1, and 6.2.0. The issue arises in the Psl\H2\ServerConnection component, which fails to validate that the total bytes received in HTTP/2 DATA frames correspond to the content-length header specified in the HEADERS frame. This oversight allows a malicious client to either send more DATA bytes than declared, bypassing application-level size restrictions, or to send fewer bytes and close the stream prematurely, leading to incorrect application behavior. The vulnerability is only exploitable for users of Psl\H2\ServerConnection who accept untrusted client traffic; those using high-level PSL APIs are not affected.
Users can upgrade to PHP Standard Library versions 6.1.2 or 6.2.1, both of which include the necessary validation and parsing fixes. Instructions for upgrading are available on the PHP Standard Library GitHub release pages for versions 6.1.2 and 6.2.1.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-444 | Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 18, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | New CVE Received | [email protected] |