Azjezz

**Name of the Vulnerable Software and Affected Versions** PHP Standard Library (PSL) versions 6.1.0 through 6.1.1 PHP Standard Library (PSL) version 6.2.0 **Description** The `PslH2ServerConnection` function does not validate that the total bytes received in DATA frames match the content-length header declared in the HEADERS frame, which allows request smuggling. This occurs when a malicious client sends more DATA bytes than declared to smuggle content past application-level size limits, or sends fewer bytes and closes the stream early, causing applications that trust the declared length to behave incorrectly. This issue is only reachable for users employing `PslH2ServerConnection` directly to accept untrusted client traffic. **Recommendations** Update versions 6.1.0 and 6.1.1 to version 6.1.2. Update version 6.2.0 to version 6.2.1. As a temporary workaround, restrict the direct use of the `PslH2ServerConnection` function to accept untrusted client traffic.