Medium severity5.3NVD Advisory· Published Apr 1, 2020· Updated Jun 17, 2026

CVE-2020-7066

Description

In PHP versions 7.2.x below 7.2.29, 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while using get_headers() with user-supplied URL, if the URL contains zero (\0) character, the URL will be silently truncated at it. This may cause some software to make incorrect assumptions about the target of the get_headers() and possibly send some information to a wrong server.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

PHP/PHP3 versions
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:php:php:*:*:*:*:*:*:*:*range: >=7.2.0,<7.2.29
- (no CPE)range: <7.2.29, <7.3.16, <7.4.4
- (no CPE)range: 7.2.x below 7.2.29
Tenable/Tenable.sc2 versions
cpe:2.3:a:tenable:tenable.sc:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:tenable:tenable.sc:*:*:*:*:*:*:*:*range: <5.19.0
- cpe:2.3:a:tenable:tenable.sc:5.19.0:*:*:*:*:*:*:*
Debian/linux3 versions
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
OpenSUSE/Leap
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
osv-coords62 versions
pkg:bitnami/libphp pkg:bitnami/php pkg:bitnami/php-min pkg:rpm/almalinux/apcu-panel pkg:rpm/almalinux/libzip pkg:rpm/almalinux/libzip-devel pkg:rpm/almalinux/libzip-tools pkg:rpm/almalinux/php pkg:rpm/almalinux/php-bcmath pkg:rpm/almalinux/php-cli pkg:rpm/almalinux/php-common pkg:rpm/almalinux/php-dba pkg:rpm/almalinux/php-dbg pkg:rpm/almalinux/php-devel pkg:rpm/almalinux/php-embedded pkg:rpm/almalinux/php-enchant pkg:rpm/almalinux/php-fpm pkg:rpm/almalinux/php-gd pkg:rpm/almalinux/php-gmp pkg:rpm/almalinux/php-intl pkg:rpm/almalinux/php-json pkg:rpm/almalinux/php-ldap pkg:rpm/almalinux/php-mbstring pkg:rpm/almalinux/php-mysqlnd pkg:rpm/almalinux/php-odbc pkg:rpm/almalinux/php-opcache pkg:rpm/almalinux/php-pdo pkg:rpm/almalinux/php-pear pkg:rpm/almalinux/php-pecl-apcu pkg:rpm/almalinux/php-pecl-apcu-devel pkg:rpm/almalinux/php-pecl-rrd pkg:rpm/almalinux/php-pecl-xdebug pkg:rpm/almalinux/php-pecl-zip pkg:rpm/almalinux/php-pgsql pkg:rpm/almalinux/php-process pkg:rpm/almalinux/php-recode pkg:rpm/almalinux/php-snmp pkg:rpm/almalinux/php-soap pkg:rpm/almalinux/php-xml pkg:rpm/almalinux/php-xmlrpc pkg:rpm/opensuse/php7&distro=openSUSE%20Leap%2015.1 pkg:rpm/opensuse/php7&distro=openSUSE%20Leap%2015.4 pkg:rpm/opensuse/php7-test&distro=openSUSE%20Leap%2015.1 pkg:rpm/opensuse/tidy&distro=openSUSE%20Leap%2015.1 pkg:rpm/suse/php5&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2012 pkg:rpm/suse/php5&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP4 pkg:rpm/suse/php7&distro=SUSE%20Enterprise%20Storage%206 pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP1-ESPOS pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP1-LTSS pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-ESPOS pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-LTSS pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015%20SP1 pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP1-BCL pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP1-LTSS pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20Server%2015-LTSS pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015 pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP1 pkg:rpm/suse/php72&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2012 pkg:rpm/suse/php72&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP4 pkg:rpm/suse/php72&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP5 pkg:rpm/suse/tidy&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP1 pkg:rpm/suse/tidy&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015%20SP1
>= 7.2.0, < 7.2.29+ 61 more
- (no CPE)range: >= 7.2.0, < 7.2.29
- (no CPE)range: >= 7.2.0, < 7.2.29
- (no CPE)range: >= 7.2.0, < 7.2.29
- (no CPE)range: < 5.1.17-1.module_el8.3.0+2009+b272fdef
- (no CPE)range: < 1.5.2-1.module_el8.5.0+152+112d3b8c
- (no CPE)range: < 1.5.2-1.module_el8.4.0+2229+b272fdef
- (no CPE)range: < 1.5.2-1.module_el8.5.0+152+112d3b8c
- (no CPE)range: < 7.3.20-1.module_el8.4.0+2229+b272fdef
- (no CPE)range: < 7.3.20-1.module_el8.4.0+2229+b272fdef
- (no CPE)range: < 7.3.20-1.module_el8.5.0+152+112d3b8c
- (no CPE)range: < 7.3.20-1.module_el8.3.0+2009+b272fdef
- (no CPE)range: < 7.3.20-1.module_el8.5.0+152+112d3b8c
- (no CPE)range: < 7.3.20-1.module_el8.3.0+2009+b272fdef
- (no CPE)range: < 7.3.20-1.module_el8.4.0+2229+b272fdef
- (no CPE)range: < 7.3.20-1.module_el8.3.0+2009+b272fdef
- (no CPE)range: < 7.3.20-1.module_el8.4.0+2229+b272fdef
- (no CPE)range: < 7.3.20-1.module_el8.5.0+152+112d3b8c
- (no CPE)range: < 7.3.20-1.module_el8.4.0+2229+b272fdef
- (no CPE)range: < 7.3.20-1.module_el8.3.0+2009+b272fdef
- (no CPE)range: < 7.3.20-1.module_el8.5.0+152+112d3b8c
- (no CPE)range: < 7.3.20-1.module_el8.3.0+2009+b272fdef
- (no CPE)range: < 7.3.20-1.module_el8.5.0+152+112d3b8c
- (no CPE)range: < 7.3.20-1.module_el8.5.0+152+112d3b8c
- (no CPE)range: < 7.3.20-1.module_el8.4.0+2229+b272fdef
- (no CPE)range: < 7.3.20-1.module_el8.3.0+2009+b272fdef
- (no CPE)range: < 7.3.20-1.module_el8.5.0+152+112d3b8c
- (no CPE)range: < 7.3.20-1.module_el8.5.0+152+112d3b8c
- (no CPE)range: < 1:1.10.9-1.module_el8.3.0+2009+b272fdef
- (no CPE)range: < 5.1.17-1.module_el8.5.0+152+112d3b8c
- (no CPE)range: < 5.1.17-1.module_el8.3.0+2009+b272fdef
- (no CPE)range: < 2.0.1-1.module_el8.6.0+2750+78feabcb
- (no CPE)range: < 2.8.0-1.module_el8.5.0+152+112d3b8c
- (no CPE)range: < 1.15.4-1.module_el8.4.0+2229+b272fdef
- (no CPE)range: < 7.3.20-1.module_el8.5.0+152+112d3b8c
- (no CPE)range: < 7.3.20-1.module_el8.4.0+2229+b272fdef
- (no CPE)range: < 7.3.20-1.module_el8.5.0+152+112d3b8c
- (no CPE)range: < 7.3.20-1.module_el8.3.0+2009+b272fdef
- (no CPE)range: < 7.3.20-1.module_el8.4.0+2229+b272fdef
- (no CPE)range: < 7.3.20-1.module_el8.4.0+2229+b272fdef
- (no CPE)range: < 7.3.20-1.module_el8.5.0+152+112d3b8c
- (no CPE)range: < 7.2.5-lp151.6.25.1
- (no CPE)range: < 7.2.34-150000.4.103.1
- (no CPE)range: < 7.2.5-lp151.6.25.1
- (no CPE)range: < 5.4.0-lp151.3.3.1
- (no CPE)range: < 5.5.14-109.76.1
- (no CPE)range: < 5.5.14-109.76.1
- (no CPE)range: < 7.2.34-150000.4.103.1
- (no CPE)range: < 7.2.34-150000.4.103.1
- (no CPE)range: < 7.2.34-150000.4.103.1
- (no CPE)range: < 7.2.34-150000.4.103.1
- (no CPE)range: < 7.2.34-150000.4.103.1
- (no CPE)range: < 7.2.5-4.55.7
- (no CPE)range: < 7.2.34-150000.4.103.1
- (no CPE)range: < 7.2.34-150000.4.103.1
- (no CPE)range: < 7.2.34-150000.4.103.1
- (no CPE)range: < 7.2.34-150000.4.103.1
- (no CPE)range: < 7.2.34-150000.4.103.1
- (no CPE)range: < 7.2.5-1.46.1
- (no CPE)range: < 7.2.5-1.46.1
- (no CPE)range: < 7.2.5-1.46.1
- (no CPE)range: < 5.4.0-3.2.1
- (no CPE)range: < 5.4.0-3.2.1

Patches

Vulnerability mechanics

References

www.tenable.com/security/tns-2021-14nvdPatchThird Party Advisory
bugs.php.net/bug.phpnvdExploitIssue TrackingPatchVendor Advisory
lists.opensuse.org/opensuse-security-announce/2020-05/msg00025.htmlnvdThird Party Advisory
lists.debian.org/debian-lts-announce/2020/04/msg00021.htmlnvdThird Party Advisory
security.netapp.com/advisory/ntap-20200403-0001/nvdThird Party Advisory
usn.ubuntu.com/4330-2/nvdThird Party Advisory
www.debian.org/security/2020/dsa-4717nvdThird Party Advisory
www.debian.org/security/2020/dsa-4719nvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.345
epss	0.002
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000