CVE-2026-48979

Publication date 17 June 2026

Last updated 3 July 2026

Ubuntu priority

Medium

Why this priority?

Cvss 3 Severity Score

7.5 · High

Score breakdown

Description

PHP Standard Library (PSL) is set of APIs covering async, collections, networking, I/O, cryptography, terminal UI, etc. In versions 6.1.0, 6.1.1 and 6.2.0, the Psl\H2\ServerConnection does not validate that the total bytes received in DATA frames match the content-length header declared in the HEADERS frame, allowing request smuggling. This is in violation of RFC 9113 ยง8.1.1. A malicious client is able to send more DATA bytes than declared, smuggling additional content past application-level size limits and send fewer DATA bytes than declared and close the stream early, causing applications that trust the declared length to behave incorrectly. The vulnerability is only reachable for consumers using Psl\H2\ServerConnection directly to accept untrusted client traffic. Consumers of documented high-level PSL APIs are not affected. This issue has been fixed in versions 6.1.2 and 6.2.1.

Read the notes from the security team

Status

Package Ubuntu Release Status
php5 26.04 LTS resolute Not in release
25.10 questing Not in release
24.04 LTS noble Not in release
22.04 LTS jammy Not in release
14.04 LTS trusty
Not affected
php7.0 26.04 LTS resolute Not in release
25.10 questing Not in release
24.04 LTS noble Not in release
22.04 LTS jammy Not in release
16.04 LTS xenial
Not affected
php7.2 26.04 LTS resolute Not in release
25.10 questing Not in release
24.04 LTS noble Not in release
22.04 LTS jammy Not in release
18.04 LTS bionic
Not affected
php7.4 26.04 LTS resolute Not in release
25.10 questing Not in release
24.04 LTS noble Not in release
22.04 LTS jammy Not in release
20.04 LTS focal
Not affected
php8.1 26.04 LTS resolute Not in release
25.10 questing Not in release
24.04 LTS noble Not in release
22.04 LTS jammy
Not affected
php8.3 26.04 LTS resolute Not in release
25.10 questing Not in release
24.04 LTS noble
Not affected
22.04 LTS jammy Not in release
php8.4 26.04 LTS resolute Not in release
25.10 questing
Not affected
24.04 LTS noble Not in release
22.04 LTS jammy Not in release
php8.5 26.04 LTS resolute
Not affected
25.10 questing Not in release
24.04 LTS noble Not in release
22.04 LTS jammy Not in release

Notes

sbeattie

PEAR issues should go against php-pear as of xenial

mdeslaur

This is an issue in "PHP Standard Library (PSL)", not python, and that isn't packaged in Ubuntu. Marking all as not-affected.

Severity score breakdown

CVSS version: CVSS v3.0

Base score 7.5 · High

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References

Other references

Access our resources on patching vulnerabilities