PHP Standard Library (PSL) is set of APIs covering async, collections, networking, I/O, cryptography, terminal UI, etc. In versions 6.1.0, 6.1.1 and 6.2.0, the Psl\H2\ServerConnection does not validate that the total bytes received in DATA frames match the content-length header declared in the HEADERS frame, allowing request smuggling. This is in violation of RFC 9113 §8.1.1. A malicious client is able to send more DATA bytes than declared, smuggling additional content past application-level size limits and send fewer DATA bytes than declared and close the stream early, causing applications that trust the declared length to behave incorrectly. The vulnerability is only reachable for consumers using Psl\H2\ServerConnection directly to accept untrusted client traffic. Consumers of documented high-level PSL APIs are not affected. This issue has been fixed in versions 6.1.2 and 6.2.1.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - PHP Standard Library (PSL) is set of APIs covering async, collections, networking, I/O, cryptography,
    terminal UI, etc. In versions 6.1.0, 6.1.1 and 6.2.0, the Psl\H2\ServerConnection does not validate that
    the total bytes received in DATA frames match the content-length header declared in the HEADERS frame,
    allowing request smuggling. This is in violation of RFC 9113 §8.1.1. A malicious client is able to send
    more DATA bytes than declared, smuggling additional content past application-level size limits and send
    fewer DATA bytes than declared and close the stream early, causing applications that trust the declared
    length to behave incorrectly. The vulnerability is only reachable for consumers using
    Psl\H2\ServerConnection directly to accept untrusted client traffic. Consumers of documented high-level
    PSL APIs are not affected. This issue has been fixed in versions 6.1.2 and 6.2.1. (CVE-2026-48979)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - PHP Standard Library (PSL) is set of APIs covering async, collections, networking, I/O, cryptography,     terminal UI, etc. In versions 6.1.0, 6.1.1 and 6.2.0, the Psl\H2\ServerConnection does not validate that     the total bytes received in DATA frames match the content-length header declared in the HEADERS frame,     allowing request smuggling. This is in violation of RFC 9113 8.1.1. A malicious client is able to send     more DATA bytes than declared, smuggling additional content past application-level size limits and send     fewer DATA bytes than declared and close the stream early, causing applications that trust the declared     length to behave incorrectly. The vulnerability is only reachable for consumers using     Psl\H2\ServerConnection directly to accept untrusted client traffic. Consumers of documented high-level     PSL APIs are not affected. This issue has been fixed in versions 6.1.2 and 6.2.1. (CVE-2026-48979)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
444076	SCA: security update for php-standard-library/h2, php-standard-library/php-standard-library (GHSA-pw9p-jvrm-f7rm)	Tenable Cloud Security	SCA Checks	Local	high
444076	SCA: security update for php-standard-library/h2, php-standard-library/php-standard-library (GHSA-pw9p-jvrm-f7rm)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
321780	Linux Distros Unpatched Vulnerability : CVE-2026-48979	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-48979

high

Tenable Plugins

high

high

high