{"id":"CVE-2026-48979","title":"PHP Standard Library: HTTP/2 server-side missing content-length validation enables request smuggling","summary":"PHP Standard Library: HTTP/2 server-side missing content-length validation enables request smuggling","severity":"high","cvss":7.5,"cwe":["CWE-444"],"vendor":"php-standard-library","product":"php-standard-library/h2","ecosystem":"composer","affected":["php-standard-library/h2 >= 6.1.0, < 6.1.2","php-standard-library/h2 >= 6.2.0, < 6.2.1","php-standard-library/php-standard-library >= 6.1.0, < 6.1.2","php-standard-library/php-standard-library >= 6.2.0, < 6.2.1"],"patched":["php-standard-library/h2 6.1.2","php-standard-library/h2 6.2.1","php-standard-library/php-standard-library 6.1.2","php-standard-library/php-standard-library 6.2.1"],"published":"2026-06-26","updated":"2026-06-26","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-pw9p-jvrm-f7rm","references":[{"url":"https://github.com/php-standard-library/php-standard-library/security/advisories/GHSA-pw9p-jvrm-f7rm"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48979"},{"url":"https://github.com/php-standard-library/php-standard-library/releases/tag/6.1.2"},{"url":"https://github.com/php-standard-library/php-standard-library/releases/tag/6.2.1"},{"url":"https://github.com/advisories/GHSA-pw9p-jvrm-f7rm"}],"tags":["ghsa","composer"],"epss":0.00267,"epssPercentile":0.19053,"ingestedAt":"2026-06-29T13:24:35.256Z","slug":"CVE-2026-48979","body":"## Overview\n\n## Impact\n\n`Psl\\H2\\ServerConnection` does not validate that the total bytes received in DATA frames match the `content-length` header declared in the HEADERS frame, in violation of RFC 9113 §8.1.1.\n\nA malicious client can:\n- Send more DATA bytes than declared, smuggling additional content past application-level size limits.\n- Send fewer DATA bytes than declared and close the stream early, causing applications that trust the declared length to behave incorrectly.\n\nThe vulnerability is only reachable for consumers using `Psl\\H2\\ServerConnection` directly to accept untrusted client traffic. The high-level `Psl\\HTTP\\Server` is in active development and was not yet released at the time of this advisory; consumers of documented high-level PSL APIs are not affected.\n\n## Patches\n\nFixed in [6.1.2](https://github.com/php-standard-library/php-standard-library/releases/tag/6.1.2) and [6.2.1](https://github.com/php-standard-library/php-standard-library/releases/tag/6.2.1).\n\n- Parses and validates the `content-length` header on incoming HEADERS (server-side only — clients do not enforce this per RFC 9110 §9.3.2).\n- Tracks cumulative DATA frame payload length per stream.\n- Throws `StreamException` on mismatch or overflow.\n\nRegression tests landed in [#781](https://github.com/php-standard-library/php-standard-library/pull/781), 9 of the new tests fail against the pre-fix code, proving the validation boundary is enforced.\n\n## Workarounds\n\nNone at the protocol layer. Applications using `Psl\\H2\\ServerConnection` directly should upgrade.\n\n## Resources\n\n- RFC 9113 §8.1.1 (HTTP/2 request/response exchange)\n- RFC 9110 §8.6 (content-length header)\n- https://github.com/php-standard-library/php-standard-library/releases/tag/6.1.2\n- https://github.com/php-standard-library/php-standard-library/releases/tag/6.2.1\n\n## Affected packages\n\n- `php-standard-library/h2 >= 6.1.0, < 6.1.2`\n- `php-standard-library/h2 >= 6.2.0, < 6.2.1`\n- `php-standard-library/php-standard-library >= 6.1.0, < 6.1.2`\n- `php-standard-library/php-standard-library >= 6.2.0, < 6.2.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `php-standard-library/h2 6.1.2`\n- `php-standard-library/h2 6.2.1`\n- `php-standard-library/php-standard-library 6.1.2`\n- `php-standard-library/php-standard-library 6.2.1`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}