Answer in brief
CVE-2026-48979 records a High severity (CVSS 7.5) security vulnerability in PHP Standard Library: HTTP/2 server-side missing content-length validation enables request smuggling. The source record does not mark it as known exploited. 4 affected packages are mapped in the feed.
Answer in brief
CVE-2026-48979 records a High severity (CVSS 7.5) security vulnerability in PHP Standard Library: HTTP/2 server-side missing content-length validation enables request smuggling. The source record does not mark it as known exploited. 4 affected packages are mapped in the feed.
Update php-standard-library/h2 to 6.1.2; php-standard-library/h2 to 6.2.1; php-standard-library/php-standard-library to 6.1.2; php-standard-library/php-standard-library to 6.2.1 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanVulnerability describes the vulnerability class recorded for this advisory. The current record does not mark CVE-2026-48979 as known exploited; continue to monitor the source for status changes. The feed includes package mappings that can be checked against lockfiles and deployed manifests.
| Package | Affected range | Fixed version |
|---|---|---|
| php-standard-library/h2composer | >=6.1.0,<6.1.2 | 6.1.2 |
| php-standard-library/h2composer | >=6.2.0,<6.2.1 | 6.2.1 |
| php-standard-library/php-standard-librarycomposer | >=6.1.0,<6.1.2 | 6.1.2 |
| php-standard-library/php-standard-librarycomposer | >=6.2.0,<6.2.1 | 6.2.1 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
CVE-2026-48979 records a High severity (CVSS 7.5) security vulnerability in PHP Standard Library: HTTP/2 server-side missing content-length validation enables request smuggling. The source record does not mark it as known exploited. 4 affected packages are mapped in the feed.
The source record does not mark it as known exploited.
Check lockfiles and deployed manifests for php-standard-library/h2, php-standard-library/h2, php-standard-library/php-standard-library.
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL GuardUpdate php-standard-library/h2 to 6.1.2; php-standard-library/h2 to 6.2.1; php-standard-library/php-standard-library to 6.1.2; php-standard-library/php-standard-library to 6.2.1 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanVulnerability describes the vulnerability class recorded for this advisory. The current record does not mark CVE-2026-48979 as known exploited; continue to monitor the source for status changes. The feed includes package mappings that can be checked against lockfiles and deployed manifests.
| Package | Affected range | Fixed version |
|---|---|---|
| php-standard-library/h2composer | >=6.1.0,<6.1.2 | 6.1.2 |
| php-standard-library/h2composer | >=6.2.0,<6.2.1 | 6.2.1 |
| php-standard-library/php-standard-librarycomposer | >=6.1.0,<6.1.2 | 6.1.2 |
| php-standard-library/php-standard-librarycomposer | >=6.2.0,<6.2.1 | 6.2.1 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
CVE-2026-48979 records a High severity (CVSS 7.5) security vulnerability in PHP Standard Library: HTTP/2 server-side missing content-length validation enables request smuggling. The source record does not mark it as known exploited. 4 affected packages are mapped in the feed.
The source record does not mark it as known exploited.
Check lockfiles and deployed manifests for php-standard-library/h2, php-standard-library/h2, php-standard-library/php-standard-library.
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard## Impact `Psl\H2\ServerConnection` does not validate that the total bytes received in DATA frames match the `content-length` header declared in the HEADERS frame, in violation of RFC 9113 §8.1.1. A malicious client can: - Send more DATA bytes than declared, smuggling additional content past application-level size limits. - Send fewer DATA bytes than declared and close the stream early, causing applications that trust the declared length to behave incorrectly. The vulnerability is only reachable for consumers using `Psl\H2\ServerConnection` directly to accept untrusted client traffic. The high-level `Psl\HTTP\Server` is in active development and was not yet released at the time of this advisory; consumers of documented high-level PSL APIs are not affected. ## Patches Fixed in [6.1.2](https://github.com/php-standard-library/php-standard-library/releases/tag/6.1.2) and [6.2.1](https://github.com/php-standard-library/php-standard-library/releases/tag/6.2.1). - Parses and validates the `content-length` header on incoming HEADERS (server-side only — clients do not enforce this per RFC 9110 §9.3.2). - Tracks cumulative DATA frame payload length per stream. - Throws `StreamException` on mismatch or overflow. Regression tests landed in [#781](https://github.com/php-standard-library/php-standard-library/pull/781), 9 of the new tests fail against the pre-fix code, proving the validation boundary is enforced. ## Workarounds None at the protocol layer. Applications using `Psl\H2\ServerConnection` directly should upgrade. ## Resources - RFC 9113 §8.1.1 (HTTP/2 request/response exchange) - RFC 9110 §8.6 (content-length header) - https://github.com/php-standard-library/php-standard-library/releases/tag/6.1.2 - https://github.com/php-standard-library/php-standard-library/releases/tag/6.2.1
## Impact `Psl\H2\ServerConnection` does not validate that the total bytes received in DATA frames match the `content-length` header declared in the HEADERS frame, in violation of RFC 9113 §8.1.1. A malicious client can: - Send more DATA bytes than declared, smuggling additional content past application-level size limits. - Send fewer DATA bytes than declared and close the stream early, causing applications that trust the declared length to behave incorrectly. The vulnerability is only reachable for consumers using `Psl\H2\ServerConnection` directly to accept untrusted client traffic. The high-level `Psl\HTTP\Server` is in active development and was not yet released at the time of this advisory; consumers of documented high-level PSL APIs are not affected. ## Patches Fixed in [6.1.2](https://github.com/php-standard-library/php-standard-library/releases/tag/6.1.2) and [6.2.1](https://github.com/php-standard-library/php-standard-library/releases/tag/6.2.1). - Parses and validates the `content-length` header on incoming HEADERS (server-side only — clients do not enforce this per RFC 9110 §9.3.2). - Tracks cumulative DATA frame payload length per stream. - Throws `StreamException` on mismatch or overflow. Regression tests landed in [#781](https://github.com/php-standard-library/php-standard-library/pull/781), 9 of the new tests fail against the pre-fix code, proving the validation boundary is enforced. ## Workarounds None at the protocol layer. Applications using `Psl\H2\ServerConnection` directly should upgrade. ## Resources - RFC 9113 §8.1.1 (HTTP/2 request/response exchange) - RFC 9110 §8.6 (content-length header) - https://github.com/php-standard-library/php-standard-library/releases/tag/6.1.2 - https://github.com/php-standard-library/php-standard-library/releases/tag/6.2.1