Executive brief
The PHP Standard Library (PSL) is a collection of components for PHP developers. A vulnerability in its HTTP/2 server component allows attackers to bypass data size limits or cause application errors by sending mismatched data lengths. This could lead to request smuggling, where an attacker interferes with how the server processes web requests, potentially bypassing security controls.
Technical details
The vulnerability exists in the `Psl\H2\ServerConnection` component of the PHP Standard Library. It fails to validate that the total bytes received in HTTP/2 DATA frames match the `content-length` header declared in the HEADERS frame, violating RFC 9113. A remote, unauthenticated attacker can exploit this by sending more data than declared to smuggle content past application-level limits, or by sending less data and closing the stream to cause incorrect application behavior. This is a classic HTTP Request Smuggling (CWE-444) issue at the protocol layer. The issue is fixed in versions 6.1.2 and 6.2.1 by implementing strict content-length tracking and validation.
Affected products
- PHP Standard Library php-standard-library/h2 >= 6.1.0, < 6.1.2; >= 6.2.0, < 6.2.1
- PHP Standard Library php-standard-library/php-standard-library >= 6.1.0, < 6.1.2; >= 6.2.0, < 6.2.1
Timeline
- 2026-05-23: disclosed
- 2026-06-17: advisory: NVD publication date
- 2026-06-26: patched: GitHub Advisory reviewed and updated