CVE-2020-7066 - get_headers() silently truncates after a null byte

Back Back to CVE browser

MEDIUM

get_headers() silently truncates after a null byte

Published Apr 1, 2020

5.3

MEDIUM

CVSS 3.1

EPSS 2.77%

Description

In PHP versions 7.2.x below 7.2.29, 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while using get_headers() with user-supplied URL, if the URL contains zero (\0) character, the URL will be silently truncated at it. This may cause some software to make incorrect assumptions about the target of the get_headers() and possibly send some information to a wrong server.

Affected products

Vendor PHP Group Product PHP Default
n/a
- Version
  7.2.x below 7.2.29
  Status
  affected
  Constraints
  -
- Version
  7.3.x below 7.3.16
  Status
  affected
  Constraints
  -
- Version
  7.4.x below 7.4.4
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

PHP Group

PHP

n/a

Version	Status	Constraints
7.2.x below 7.2.29	affected	-
7.3.x below 7.3.16	affected	-
7.4.x below 7.4.4	affected	-

Red Hat Enterprise Linux 8

php:7.3-8020020200715124551.ceb1cf90

Fixed · RHSA-2020:3662
Red Hat Software Collections for Red Hat Enterprise Linux 7

rh-php73-php-0:7.3.20-1.el7

Fixed · RHSA-2020:5275
Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS

rh-php73-php-0:7.3.20-1.el7

Fixed · RHSA-2020:5275
Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS

rh-php73-php-0:7.3.20-1.el7

Fixed · RHSA-2020:5275
Red Hat Enterprise Linux 5

php

Not affected
Red Hat Enterprise Linux 5

php53

Not affected
Red Hat Enterprise Linux 6

php

Not affected
Red Hat Enterprise Linux 7

php

Not affected
Red Hat Enterprise Linux 8

php:7.2/php

Fix deferred
Red Hat Software Collections

rh-php72-php

Fix deferred

Product	Package	State	Advisory
Red Hat Enterprise Linux 8	php:7.3-8020020200715124551.ceb1cf90	Fixed	RHSA-2020:3662
Red Hat Software Collections for Red Hat Enterprise Linux 7	rh-php73-php-0:7.3.20-1.el7	Fixed	RHSA-2020:5275
Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS	rh-php73-php-0:7.3.20-1.el7	Fixed	RHSA-2020:5275
Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS	rh-php73-php-0:7.3.20-1.el7	Fixed	RHSA-2020:5275
Red Hat Enterprise Linux 5	php	Not affected	n/a
Red Hat Enterprise Linux 5	php53	Not affected	n/a
Red Hat Enterprise Linux 6	php	Not affected	n/a
Red Hat Enterprise Linux 7	php	Not affected	n/a
Red Hat Enterprise Linux 8	php:7.2/php	Fix deferred	n/a
Red Hat Software Collections	rh-php72-php	Fix deferred	n/a

Remediation

No remediation recorded yet.

Metrics

2.77% 0.02767

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 4, 2026.

EPSS probability 0.02767

Score over time

2021-2026

EPSS v1
EPSS v5
EPSS v2
EPSS v3
EPSS v4

Percentile over time

EPSS v1
EPSS v5
EPSS v2
EPSS v3
EPSS v4

Table of values (17 key points)

Flat stretches are collapsed. Showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 4, 2026	2.77% (0.02767)	85.81th	v5 (v2026.06.15)
Jun 15, 2026	2.77% (0.02767)	84.35th	v5 (v2026.06.15)
Mar 30, 2025	1.87% (0.01871)	81.48th	v4 (v2025.03.14)
Mar 29, 2025	18.92% (0.18923)	92.29th	v4 (v2025.03.14)
Mar 17, 2025	1.87% (0.01871)	81.90th	v4 (v2025.03.14)
Dec 12, 2024	0.43% (0.00434)	75.41th	v3 (v2023.03.01)
Jul 11, 2024	0.43% (0.00434)	74.80th	v3 (v2023.03.01)
Feb 8, 2024	0.58% (0.00582)	77.43th	v3 (v2023.03.01)
Mar 7, 2023	0.43% (0.00427)	70.39th	v3 (v2023.03.01)
Mar 6, 2023	1.18% (0.01183)	61.76th	v2 (v2022.01.01)
Apr 1, 2022	1.18% (0.01183)	58.77th	v2 (v2022.01.01)
Feb 4, 2022	11.69% (0.11687)	88.96th	v2 (v2022.01.01)
Feb 3, 2022	7.85% (0.07855)	85.01th	v1
Jan 6, 2022	7.85% (0.07855)	84.84th	v1
Jan 5, 2022	1.86% (0.01865)	76.93th	v5 (v2026.06.15)
Jul 23, 2021	1.86% (0.01865)	0.00th	v1
Apr 14, 2021	1.66% (0.01659)	0.00th	v1

Weaknesses (2)

CWE-170

CWE-200

Exposure of Sensitive Information

References (12)

http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00025.html
vendor-advisoryx_refsource_SUSEThird Party Advisory
https://access.redhat.com/security/cve/CVE-2020-7066
Vendor Advisory
https://bugs.php.net/bug.php?id=79329
x_refsource_MISCExploitIssue TrackingPatchVendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1820604
Issue Tracking
https://lists.debian.org/debian-lts-announce/2020/04/msg00021.html
mailing-listx_refsource_MLISTThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-7066
https://security.netapp.com/advisory/ntap-20200403-0001/
x_refsource_CONFIRMThird Party Advisory
https://usn.ubuntu.com/4330-2/
vendor-advisoryx_refsource_UBUNTUThird Party Advisory
https://www.cve.org/CVERecord?id=CVE-2020-7066
https://www.debian.org/security/2020/dsa-4717
vendor-advisoryx_refsource_DEBIANThird Party Advisory
https://www.debian.org/security/2020/dsa-4719
vendor-advisoryx_refsource_DEBIANThird Party Advisory
https://www.tenable.com/security/tns-2021-14
x_refsource_CONFIRMPatchThird Party Advisory

Link	Providers	Tags
http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00025.html		vendor-advisoryx_refsource_SUSEThird Party Advisory
https://access.redhat.com/security/cve/CVE-2020-7066		Vendor Advisory
https://bugs.php.net/bug.php?id=79329		x_refsource_MISCExploitIssue TrackingPatchVendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1820604		Issue Tracking
https://lists.debian.org/debian-lts-announce/2020/04/msg00021.html		mailing-listx_refsource_MLISTThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-7066
https://security.netapp.com/advisory/ntap-20200403-0001/		x_refsource_CONFIRMThird Party Advisory
https://usn.ubuntu.com/4330-2/		vendor-advisoryx_refsource_UBUNTUThird Party Advisory
https://www.cve.org/CVERecord?id=CVE-2020-7066
https://www.debian.org/security/2020/dsa-4717		vendor-advisoryx_refsource_DEBIANThird Party Advisory
https://www.debian.org/security/2020/dsa-4719		vendor-advisoryx_refsource_DEBIANThird Party Advisory
https://www.tenable.com/security/tns-2021-14		x_refsource_CONFIRMPatchThird Party Advisory