PHP Standard Library CVE-2026-48979

Exploitation requires that the target application directly instantiates Psl\H2\ServerConnection from PSL 6.1.0, 6.1.1, or 6.2.0 to terminate untrusted HTTP/2 client traffic - applications that consume only the documented high-level PSL HTTP APIs are not reachable. No authentication or user interaction is needed (PR:N/UI:N), the attacker only needs the ability to open an HTTP/2 stream to the server, and the application must trust the declared content-length when processing the body (otherwise the smuggling is benign). Realistic risk is bounded by how unusual this low-level integration pattern is in production deployments.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N (7.5 High) accurately reflects a network-reachable, unauthenticated integrity-only smuggling primitive - confidentiality and availability are not directly affected, but downstream integrity impact can be severe depending on what the application trusts. There is no EPSS score, no KEV listing, and no POC referenced; the release notes explicitly state discovery was internal and pre-public, so this should be treated as a real but not actively exploited issue. The most important caveat is the narrow reachability condition: only deployments that build directly on Psl\H2\ServerConnection to terminate untrusted HTTP/2 traffic are exposed, which is likely a small subset of PSL users, so prioritization should be driven by an inventory check rather than raw CVSS.

A remote attacker opens an HTTP/2 stream against a PSL-backed server, sends a HEADERS frame declaring content-length: 100, then sends DATA frames totaling either 200 bytes (smuggling 100 extra bytes past size limits or into a co-tenant request boundary) or only 50 bytes followed by END_STREAM (forcing the application to act on a truncated body it believes is complete). The attacker can use this to bypass application-level size caps, poison logs/queues that key on content-length, or induce inconsistent state in handlers that trust the declared length. No public exploit identified at time of analysis.