CVE-2026-48979: PHP Standard Library: HTTP/2 server-side missing content-length validation enables request smuggling

Synopsis

This is an HTTP/2 request smuggling vulnerability in the PHP Standard Library (PSL), specifically in the Psl\H2\ServerConnection component affecting versions 6.1.0, 6.1.1, and 6.2.0. The flaw is reachable over the network with no authentication required, and exploits a missing validation step where the library fails to confirm that the bytes received in HTTP/2 DATA frames match the content-length value declared in the HEADERS frame. A successful attacker can smuggle extra bytes past application-level size limits or cause applications that trust the declared length to behave incorrectly, enabling data tampering at the application layer. No fix versions have been published yet; HarborGuard tracks this advisory and will surface a patched-image rebuild the moment upstream ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable ServerConnection accepts client traffic over the network, so an attacker must be able to reach the exposed HTTP/2 service from the internet or an internal network segment.

• AuthenticationNot required

  No credentials or account are needed; any client that can open an HTTP/2 connection to the service can attempt the smuggling attack.

• Victim interactionNot required

  The attack is fully client-driven and requires no action from a legitimate user or operator on the server side.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special timing, race conditions, or environmental prerequisites beyond reaching the service.

Blast Radius

• An attacker sends more DATA bytes than declared in the HEADERS frame, smuggling content past application-level size checks and request filters.
• An attacker sends fewer DATA bytes than declared and closes the stream early, causing application logic that trusts the declared content-length to process incomplete or misaligned request bodies.
• Both variants allow manipulation of server-side request handling, with integrity impact rated HIGH, meaning persisted state, routing decisions, or downstream service behavior can be corrupted or manipulated based on the smuggled content.