CVE-2026-48979

Name of the Vulnerable Software and Affected Versions PHP Standard Library (PSL) versions 6.1.0 through 6.1.1 PHP Standard Library (PSL) version 6.2.0

Description The PslH2ServerConnection function does not validate that the total bytes received in DATA frames match the content-length header declared in the HEADERS frame, which allows request smuggling. This occurs when a malicious client sends more DATA bytes than declared to smuggle content past application-level size limits, or sends fewer bytes and closes the stream early, causing applications that trust the declared length to behave incorrectly. This issue is only reachable for users employing PslH2ServerConnection directly to accept untrusted client traffic.

Recommendations Update versions 6.1.0 and 6.1.1 to version 6.1.2. Update version 6.2.0 to version 6.2.1. As a temporary workaround, restrict the direct use of the PslH2ServerConnection function to accept untrusted client traffic.