CVE-2026-48979: HTTP/2 Request Smuggling in PHP Standard Library – Patch PSL 6.1.2 / 6.2.1

Technical summary

CVE-2026-48979 exploits a validation gap in Psl\H2\ServerConnection whereby incoming HTTP/2 DATA frames are not reconciled against the content-length header specified in the preceding HEADERS frame. RFC 9113 §8.1.1 mandates this validation to prevent request smuggling; PSL versions 6.1.0, 6.1.1, and 6.2.0 omit it. An attacker can send more bytes than declared (smuggling additional content), or fewer bytes followed by stream closure (causing truncation). The vulnerability manifests at the protocol-handling layer and is classified as CWE-444 (HTTP Request Smuggling), with a CVSS 3.1 score of 7.5 (HIGH). The attack surface is limited to applications directly instantiating and using Psl\H2\ServerConnection to handle untrusted HTTP/2 clients.

Business impact

Organizations deploying custom HTTP/2 servers built directly on Psl\H2\ServerConnection may experience request smuggling attacks that bypass application-level input validation, request size limits, or other business logic safeguards. This can lead to data exfiltration, privilege escalation, or injection attacks if downstream code processes the smuggled data. The integrity risk is significant—attackers can corrupt request semantics without detection by application firewalls or rate-limiting controls. However, the footprint is limited to applications that have chosen to use the low-level PSL API rather than higher-level frameworks.

Affected systems

Vulnerable versions: PSL 6.1.0, 6.1.1, and 6.2.0. Fixed versions: PSL 6.1.2 and 6.2.1. Only applications directly using Psl\H2\ServerConnection for HTTP/2 request handling are at risk. Applications using PSL through documented public APIs (async, collections, networking, I/O, cryptography, terminal UI abstractions) are not affected. No third-party vendors or products are listed as affected at this time.

Exploitability

Exploitation requires network access to an application using the vulnerable ServerConnection class and the ability to send HTTP/2 requests. The attack is straightforward—no authentication or user interaction is needed. An attacker simply crafts an HTTP/2 request with mismatched content-length and actual DATA frame sizes. The low complexity and lack of prerequisites make this a practical attack vector for exposed services, though the specific scope (low-level API usage) limits the number of vulnerable deployments in the wild.

Remediation

Upgrade to PSL 6.1.2 or 6.2.1 immediately. For version 6.1.x users, apply 6.1.2; for version 6.2.x users, apply 6.2.1. There is no documented workaround for versions 6.1.0–6.2.0 short of patching. Review your codebase to identify any direct instantiation of Psl\H2\ServerConnection; if found, prioritize patching. If you are using PSL only through its high-level APIs, you are not affected and no immediate action is required, though staying current with minor releases is advisable.

Patch guidance

Patches are available in PSL 6.1.2 and 6.2.1. Version selection depends on your current deployment: if running 6.1.x, upgrade to 6.1.2; if running 6.2.0, upgrade to 6.2.1. These point releases address only the validation gap and are considered safe for production deployment. Test the upgrade in a staging environment first to ensure compatibility with any custom extensions or integrations, though the fix is localized to HTTP/2 frame validation and should have minimal side effects.

Detection guidance

Monitor HTTP/2 traffic patterns for DATA frames whose byte counts deviate from declared content-length values, particularly on systems running PSL 6.1.0–6.2.0. Network-level detection is challenging; application logging is more reliable. If possible, instrument Psl\H2\ServerConnection with logging to capture frame-level details. Look for unusual request sizes, truncated payloads, or repeated stream resets. Intrusion detection systems (IDS) tuned to HTTP/2 anomalies may flag mismatched sizes if they perform deep inspection.

Why prioritize this

This vulnerability merits urgent patching for any organization using Psl\H2\ServerConnection directly. The CVSS score of 7.5 reflects high integrity impact with no confidentiality loss. Request smuggling is a well-established attack vector with real-world exploitation potential, and the fix is a simple upgrade with low deployment risk. However, the narrow scope (low-level API only) means most PSL users face no exposure, so inventory your codebase first to confirm exposure before broadly escalating.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects: Network-accessible attack vector (AV:N), low attack complexity (AC:L), no privilege or user interaction required (PR:N, UI:N), no scope change (S:U), no confidentiality impact (C:N), high integrity impact (I:H), and no availability impact (A:N). The integrity rating is driven by the attacker's ability to inject or truncate request data, deceiving downstream applications. The lack of availability or confidentiality impact prevents a critical rating, but the ease of exploitation and real-world consequences of request smuggling justify the HIGH designation.

Frequently asked questions