Technical impact
The vulnerability lies in the PSL HTTP/2 ServerConnection, which fails to verify that the total bytes received in DATA frames match the Content-Length declared in the HEADERS frame. A malicious client can send more or fewer bytes than specified, allowing request smuggling. This causes applications that rely on the declared length to accept unexpected or truncated data, potentially bypassing size limits or affecting application logic. The weakness is formally identified as CWE‑444.
Affected Systems
The issue affects PHP Standard Library versions 6.1.0, 6.1.1, and 6.2.0 for consumers that invoke Psl\H2\ServerConnection directly to accept untrusted HTTP/2 traffic. Applications using higher‑level PSL APIs are not affected. The fix is released in 6.1.2 and 6.2.1.
Risk and Exploitability
With a CVSS score of 7.5, the vulnerability presents moderate to high severity, and the EPSS score of less than 1% indicates a very low current probability of exploitation. It is not listed in the CISA KEV catalog. Because the flaw is only reachable when developers use the low‑level ServerConnection class with external clients, the attack vector requires a client that can speak HTTP/2 and send crafted frames. An attacker would need to target an application that directly instantiates this class for incoming traffic.
Github GHSA