GHSA-pw9p-jvrm-f7rm PHP Standard Library: HTTP/2 server-side missing content-length validation enables request smuggling

• Packagist php-standard-library/h2: >= 6.1.0, < 6.1.2 → fixed in 6.1.2 • Packagist php-standard-library/h2: >= 6.2.0, < 6.2.1 → fixed in 6.2.1 • Packagist php-standard-library/php-standard-library: >= 6.1.0, < 6.1.2 → fixed in 6.1.2 • Packagist php-standard-library/php-standard-library: >= 6.2.0, < 6.2.1 → fixed in 6.2.1

Impact `Psl\H2\ServerConnection` does not validate that the total bytes received in DATA frames match the `content-length` header declared in the HEADERS frame, in violation of RFC 9113 §8.1.1. A malicious client can: • Send more DATA bytes than declared, smuggling additional content past application-level size limits. • Send fewer DATA bytes than declared and close the stream early, causing applications that trust the declared length to behave incorrectly. The vulnerability is only reachable for consumers using `Psl\H2\ServerConnection` directly to accept untrusted client traffic. The high-level `Psl\HTTP\Server` is in active development and was not yet released at the time of this advisory; consumers of documented high-level PSL APIs are not affected. Patches Fixed in 6.1.2 and 6.2.1. • Parses and validates the `content-length` header on incoming HEADERS (server-side only — clients do not enforce this per RFC 9110 §9.3.2). • Tracks cumulative DATA frame payload length per stream. • Throws `StreamException` on mismatch or overflow. Regression tests landed in #781, 9 of the new tests fail against the pre-fix code, proving the validation boundary is enforced. Workarounds None at the protocol layer. Applications using `Psl\H2\ServerConnection` directly should upgrade. Resources • RFC 9113 §8.1.1 (HTTP/2 request/response exchange) • RFC 9110 §8.6 (content-length header) • https://github.com/php-standard-library/php-standard-library/releases/tag/6.1.2 • https://github.com/php-standard-library/php-standard-library/releases/tag/6.2.1