Php Standard Library
Monthly
HTTP/2 request smuggling in PHP Standard Library (PSL) versions 6.1.0, 6.1.1, and 6.2.0 lets remote unauthenticated clients desynchronize stream boundaries in Psl\H2\ServerConnection by sending DATA frame totals that disagree with the declared content-length header. Only applications that consume the low-level H2 server connection directly to accept untrusted traffic are exposed; high-level PSL APIs are unaffected. No public exploit identified at time of analysis, and the maintainers state the issue was found during internal review prior to public exploitation.
HTTP/2 request smuggling in PHP Standard Library (PSL) versions 6.1.0, 6.1.1, and 6.2.0 lets remote unauthenticated clients desynchronize stream boundaries in Psl\H2\ServerConnection by sending DATA frame totals that disagree with the declared content-length header. Only applications that consume the low-level H2 server connection directly to accept untrusted traffic are exposed; high-level PSL APIs are unaffected. No public exploit identified at time of analysis, and the maintainers state the issue was found during internal review prior to public exploitation.