Threats tagged 'ghsa-pw9p-jvrm-f7rm'

The PHP Standard Library's HTTP/2 server implementation (Psl\H2\ServerConnection) lacks validation that the total bytes received in DATA frames match the content-length header declared in the HEADERS frame, violating RFC 9113 §8.1.1. This allows a malicious client to send more or fewer DATA bytes than declared, potentially leading to request smuggling or incorrect application behavior. The vulnerability affects only consumers directly using Psl\H2\ServerConnection to accept untrusted client traffic; higher-level PSL HTTP server APIs are not affected. Fixes are available in versions 6.1.2 and 6.2.1. No protocol-layer workarounds exist, so upgrading is necessary for affected users.