CVE-2026-48979

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-48979
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48979.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-48979
Aliases
Downstream
Published
2026-06-17T20:43:25.971Z
Modified
2026-07-15T01:48:58.152718549Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
PHP Standard Library: HTTP/2 server-side missing content-length validation enables request smuggling
Details

PHP Standard Library (PSL) is set of APIs covering async, collections, networking, I/O, cryptography, terminal UI, etc. In versions 6.1.0, 6.1.1 and 6.2.0, the Psl\H2\ServerConnection does not validate that the total bytes received in DATA frames match the content-length header declared in the HEADERS frame, allowing request smuggling. This is in violation of RFC 9113 ยง8.1.1. A malicious client is able to send more DATA bytes than declared, smuggling additional content past application-level size limits and send fewer DATA bytes than declared and close the stream early, causing applications that trust the declared length to behave incorrectly. The vulnerability is only reachable for consumers using Psl\H2\ServerConnection directly to accept untrusted client traffic. Consumers of documented high-level PSL APIs are not affected. This issue has been fixed in versions 6.1.2 and 6.2.1.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48979.json",
    "cwe_ids": [
        "CWE-444"
    ]
}
References

Affected packages

Git / github.com/php-standard-library/php-standard-library

Affected ranges

Type
GIT
Repo
https://github.com/php-standard-library/php-standard-library
Events
Introduced
819b59a9613fd77d29e7c9aaf073716c73f7e053
Introduced
dafb10a4db658575280d1abc4698c5d548414a85
Fixed
294ee920a35ff526a44d90c41cb5459ddb97b4a6
Fixed
331f3ab363508825e62c42725f96c091bcceb970
Database specific 
{
    "extracted_events": [
        {
            "introduced": "6.1.0"
        },
        {
            "fixed": "6.1.2"
        },
        {
            "introduced": "6.2.0"
        },
        {
            "fixed": "6.2.1"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

6.*
6.1.0
6.1.1
6.2.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48979.json"