CVE-2026-48979High· 7.5▾ TwilightPHP Standard Library: HTTP/2 server-side missing content-length validation enables request smuggling
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 4.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.3%
Psl\H2\ServerConnection does not validate that the total bytes received in DATA frames match the content-length header declared in the HEADERS frame, in violation of RFC 9113 §8.1.1.
A malicious client can:
The vulnerability is only reachable for consumers using Psl\H2\ServerConnection directly to accept untrusted client traffic. The high-level Psl\HTTP\Server is in active development and was not yet released at the time of this advisory; consumers of documented high-level PSL APIs are not affected.
content-length header on incoming HEADERS (server-side only — clients do not enforce this per RFC 9110 §9.3.2).StreamException on mismatch or overflow.Regression tests landed in #781, 9 of the new tests fail against the pre-fix code, proving the validation boundary is enforced.
None at the protocol layer. Applications using Psl\H2\ServerConnection directly should upgrade.
php-standard-library/h2 >= 6.1.0, < 6.1.2php-standard-library/h2 >= 6.2.0, < 6.2.1php-standard-library/php-standard-library >= 6.1.0, < 6.1.2php-standard-library/php-standard-library >= 6.2.0, < 6.2.1Upgrade to a patched release:
php-standard-library/h2 6.1.2php-standard-library/h2 6.2.1php-standard-library/php-standard-library 6.1.2php-standard-library/php-standard-library 6.2.1Connected by shared product, vendor, weakness, or advisory.
CVE-2021-33037Medium· 5.3Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request smuggling when used with a reverse pr…
CVE-2023-41265Critical· 9.6An HTTP Request Tunneling vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier all…
CVE-2026-14180Medium· 5.3A flaw was found in the ChunkReader component of the Undertow HTTP server, which is used by WildFly and JBoss EAP to handle chunked transfer encoding
CVE-2026-73548High· 7.5Envoy is an open source edge and service proxy designed for cloud-native applications
CVE-2026-82672Medium· 6.3Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in elixir-mint mint allows a malicious HTTP/1 server to desynchronize a strict intermediary and the Mint client on a pooled connection, enabli…
CVE-2026-93574Medium· 6.5A flaw was found in Netty's `netty-codec-http` component