Executive Summary

The vulnerability exists in the PHP Standard Library (PSL) versions 6.1.0, 6.1.1, and 6.2.0 within the Psl\H2\ServerConnection component. It fails to validate that the total bytes received in DATA frames match the content-length header declared in the HEADERS frame, which violates RFC 9113 §8.1.1.

This flaw allows a malicious client to perform request smuggling by sending more DATA bytes than declared, bypassing application-level size limits, or by sending fewer DATA bytes than declared and closing the stream early, causing applications that rely on the declared length to behave incorrectly.

The vulnerability only affects consumers who use Psl\H2\ServerConnection directly to accept untrusted client traffic. Consumers using higher-level documented PSL APIs are not affected. The issue has been fixed in versions 6.1.2 and 6.2.1.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing a malicious client to smuggle additional content past application-level size limits or prematurely close streams, which can cause your application to behave incorrectly.

Such behavior can lead to security issues like bypassing input validation, triggering unexpected application logic, or potentially enabling further attacks that rely on manipulating request boundaries.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade the PHP Standard Library (PSL) to version 6.1.2 or 6.2.1 or later, where the issue has been fixed.

Additionally, avoid using Psl\H2\ServerConnection directly to accept untrusted client traffic, as the vulnerability only affects consumers using this API directly.

Useful 0 Not Useful 0