PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-48979 php-standard-library CVE debrief

The PHP Standard Library (PSL) contains a high-severity vulnerability, CVE-2026-48979, affecting versions 6.1.0, 6.1.1, and 6.2.0. This vulnerability allows for request smuggling due to improper validation of DATA frames in the Psl/H2/Server. A malicious client can exploit this by sending more or fewer DATA bytes than declared, potentially bypassing application-level size limits or causing incorrect behavior in applications that trust the declared length. This issue is fixed in versions 6.1.2 and 6.2.1. The vulnerability is only reachable for consumers using Psl/H2/Server directly to accept untrusted client traffic, while users of documented high-level PSL APIs are not affected.

Vendor
php-standard-library
Product
Unknown
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-17
Original CVE updated
2026-06-23
Advisory published
2026-06-17
Advisory updated
2026-06-23

Who should care

Developers and administrators using PHP Standard Library (PSL) versions 6.1.0, 6.1.1, or 6.2.0 should be aware of this vulnerability. Specifically, those who directly use Psl/H2/Server to handle untrusted client traffic are at risk. Users of high-level PSL APIs are not affected.

Technical summary

The Psl/H2/Server in PHP Standard Library (PSL) versions 6.1.0, 6.1.1, and 6.2.0 does not properly validate the total bytes received in DATA frames against the content-length header declared in the HEADERS frame. This violates RFC 9113 §8.1.1 and allows for request smuggling. An attacker can exploit this by sending more DATA bytes than declared to smuggle additional content past size limits or send fewer bytes and close the stream early, causing applications that rely on the declared length to behave incorrectly.

Defensive priority

High

Recommended defensive actions

  • Upgrade to PHP Standard Library version 6.1.2 or 6.2.1 immediately.
  • Review and update any applications or services using Psl/H2/Server to handle untrusted client traffic.
  • Implement additional monitoring for unusual traffic patterns that could indicate exploitation attempts.
  • Ensure that applications relying on PSL do not trust declared lengths for DATA frames without proper validation.
  • Consider using documented high-level PSL APIs if not already in use.
  • Review RFC 9113 §8.1.1 for a deeper understanding of the HTTP/2 specification and potential mitigations.

Evidence notes

This vulnerability is confirmed by the CVE record and details from the National Vulnerability Database (NVD). The CVE was published on 2026-06-17 and modified on 2026-06-18. Fixes are available in versions 6.1.2 and 6.2.1 of the PHP Standard Library.

Official resources

public