php-standard-library up to 6.1.1/6.2.0 request smuggling

Summaryinfo

A vulnerability categorized as problematic has been discovered in php-standard-library up to 6.1.1/6.2.0. The affected element is an unknown function. The manipulation results in request smuggling. This vulnerability is cataloged as CVE-2026-48979. The attack may be launched remotely. There is no exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic has been found in php-standard-library up to 6.1.1/6.2.0. Affected is an unknown functionality. The manipulation with an unknown input leads to a request smuggling vulnerability. CWE is classifying the issue as CWE-444. The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination. This is going to have an impact on integrity. CVE summarizes:

PHP Standard Library (PSL) is set of APIs covering async, collections, networking, I/O, cryptography, terminal UI, etc. In versions 6.1.0, 6.1.1 and 6.2.0, the Psl\H2\ServerConnection does not validate that the total bytes received in DATA frames match the content-length header declared in the HEADERS frame, allowing request smuggling. This is in violation of RFC 9113 §8.1.1. A malicious client is able to send more DATA bytes than declared, smuggling additional content past application-level size limits and send fewer DATA bytes than declared and close the stream early, causing applications that trust the declared length to behave incorrectly. The vulnerability is only reachable for consumers using Psl\H2\ServerConnection directly to accept untrusted client traffic. Consumers of documented high-level PSL APIs are not affected. This issue has been fixed in versions 6.1.2 and 6.2.1.

The advisory is available at github.com. This vulnerability is traded as CVE-2026-48979 since 05/27/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. The technical details are unknown and an exploit is not available.

The vulnerability scanner Nessus provides a plugin with the ID 321780 (Linux Distros Unpatched Vulnerability : CVE-2026-48979), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 6.1.2 or 6.2.1 eliminates this vulnerability. The upgrade is hosted for download at github.com.

The vulnerability is also documented in the vulnerability database at Tenable (321780). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Software Library

Name

• php-standard-library

Version

• 6.0
• 6.1
• 6.1.0
• 6.1.1
• 6.2.0

Website

• Product: https://github.com/php-standard-library/php-standard-library/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion