CVE-2026-48979 Overview
CVE-2026-48979 is an HTTP request smuggling vulnerability [CWE-444] in the PHP Standard Library (PSL), a set of APIs covering async, collections, networking, I/O, cryptography, and terminal UI. The flaw resides in Psl\H2\ServerConnection, which fails to validate that the total bytes received in HTTP/2 DATA frames match the content-length header declared in the preceding HEADERS frame. This validation gap violates RFC 9113 §8.1.1 and allows a malicious client to smuggle additional content past application-level size limits or terminate streams early. Versions 6.1.0, 6.1.1, and 6.2.0 are affected. Fixes are available in versions 6.1.2 and 6.2.1.
Critical Impact
Attackers can smuggle request content past size enforcement or truncate streams, causing applications that trust the declared content length to process incorrect data.
Affected Products
- PHP Standard Library (PSL) version 6.1.0
- PHP Standard Library (PSL) version 6.1.1
- PHP Standard Library (PSL) version 6.2.0
Discovery Timeline
- 2026-06-17 - CVE-2026-48979 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2026-48979
Vulnerability Analysis
The vulnerability affects the HTTP/2 server implementation in PSL. When a client establishes an HTTP/2 stream, it sends a HEADERS frame declaring a content-length value, followed by one or more DATA frames carrying the message body. RFC 9113 §8.1.1 requires servers to verify that the sum of DATA frame payloads matches the declared content-length. The Psl\H2\ServerConnection implementation skips this check.
The impact splits into two distinct primitives. A client can send more DATA bytes than declared, bypassing application-level size limits that inspect only the header value. A client can also send fewer DATA bytes than declared and close the stream early, leaving downstream consumers with truncated content they believe to be complete. Both behaviors enable HTTP request smuggling against applications that rely on the declared length for parsing or enforcement decisions.
Root Cause
The root cause is missing input validation in the HTTP/2 frame processing path. The server connection logic accepts DATA frames without reconciling cumulative payload length against the content-length value parsed from the HEADERS frame. The condition is classified as CWE-444 (Inconsistent Interpretation of HTTP Requests).
Attack Vector
Exploitation requires network access to a service exposing Psl\H2\ServerConnection directly to untrusted client traffic. No authentication or user interaction is required. Consumers using only the documented high-level PSL APIs are not affected, as the vulnerable code path is reached only through direct use of the low-level server connection class. An attacker crafts an HTTP/2 request with a content-length value that disagrees with the actual DATA frame payload size to trigger smuggling.
Detailed reproduction steps and patch context are available in the GitHub Security Advisory GHSA-pw9p-jvrm-f7rm.
Detection Methods for CVE-2026-48979
Indicators of Compromise
- HTTP/2 streams where cumulative DATA frame payload size deviates from the content-length value declared in the HEADERS frame.
- Premature END_STREAM flags on DATA frames carrying fewer bytes than declared.
- Application logs showing request bodies exceeding documented size limits despite header-based enforcement.
Detection Strategies
- Deploy an HTTP/2-aware reverse proxy or web application firewall in front of PSL-based services to enforce RFC 9113 §8.1.1 compliance.
- Add instrumentation in application code to compare bytes read from the request body against the declared Content-Length header and log discrepancies.
- Review dependency manifests (composer.json, composer.lock) for php-standard-library/php-standard-library versions 6.1.0, 6.1.1, or 6.2.0.
Monitoring Recommendations
- Alert on requests where the request body byte count does not match the Content-Length header value at the application layer.
- Monitor for repeated stream resets or early-close conditions originating from the same client identifier.
- Track upgrades of the php-standard-library package across build pipelines to confirm remediation reaches production.
How to Mitigate CVE-2026-48979
Immediate Actions Required
- Upgrade php-standard-library/php-standard-library to version 6.1.2 if running the 6.1.x branch, or to version 6.2.1 if running the 6.2.x branch.
- Inventory all services that consume Psl\H2\ServerConnection directly and prioritize them for patching.
- If direct use of Psl\H2\ServerConnection is not required, refactor to a documented high-level PSL API, which is not affected.
Patch Information
The maintainers released fixes in PSL 6.1.2 and PSL 6.2.1. Both releases add validation that the cumulative DATA frame payload matches the declared content-length value, aligning the implementation with RFC 9113 §8.1.1.
Workarounds
- Place an HTTP/2-compliant reverse proxy in front of the application to terminate and revalidate client connections.
- Avoid exposing Psl\H2\ServerConnection directly to untrusted networks until the patched version is deployed.
- Enforce request body size limits at the network or proxy layer rather than relying on the Content-Length header inside the application.
# Upgrade to a patched PSL version using Composer
composer require azjezz/psl:^6.2.1
# or, for the 6.1.x branch
composer require azjezz/psl:^6.1.2
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
