Packagist/php-standard-library/h2 CVE-2026-48979: high 7.5, EPSS 0.27%
PHP Standard Library: HTTP/2 server-side missing content-length validation enables request smuggling
Action: Upgrade php-standard-library/h2 to 6.1.2 or later.
composer require php-standard-library/h2:6.1.2composer require php-standard-library/h2:6.2.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 6.1.0 | 6.1.2 | - |
| 6.2.0 | 6.2.1 | - |
Fixed versions
| 6.1.2 | 6.2.1 |
Sources
- osv: GHSA-pw9p-jvrm-f7rm
- https://github.com/php-standard-library/php-standard-library/security/advisories/GHSA-pw9p-jvrm-f7rm
- https://nvd.nist.gov/vuln/detail/CVE-2026-48979
- https://github.com/php-standard-library/php-standard-library
- https://github.com/php-standard-library/php-standard-library/releases/tag/6.1.2
- https://github.com/php-standard-library/php-standard-library/releases/tag/6.2.1
CVE-2026-48979 · published · modified · JSON