CVE-2020-7066

In PHP versions 7.2.x below 7.2.29, 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while using get_headers() with user-supplied URL, if the URL contains zero (\0) character, the URL will be silently truncated at it. This may cause some software to make incorrect assumptions about the target of the get_headers() and possibly send some information to a wrong server.

• CWE-170

• http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00025.htmlThird Party Advisory
• https://bugs.php.net/bug.php?id=79329Exploit, Issue Tracking, Patch, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2020/04/msg00021.htmlThird Party Advisory
• https://security.netapp.com/advisory/ntap-20200403-0001/Third Party Advisory
• https://usn.ubuntu.com/4330-2/Third Party Advisory
• https://www.debian.org/security/2020/dsa-4717Third Party Advisory
• https://www.debian.org/security/2020/dsa-4719Third Party Advisory
• https://www.tenable.com/security/tns-2021-14Patch, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00025.htmlThird Party Advisory
• https://bugs.php.net/bug.php?id=79329Exploit, Issue Tracking, Patch, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2020/04/msg00021.htmlThird Party Advisory
• https://security.netapp.com/advisory/ntap-20200403-0001/Third Party Advisory
• https://usn.ubuntu.com/4330-2/Third Party Advisory
• https://www.debian.org/security/2020/dsa-4717Third Party Advisory
• https://www.debian.org/security/2020/dsa-4719Third Party Advisory
• https://www.tenable.com/security/tns-2021-14Patch, Third Party Advisory

Published

Apr 1, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-7060When using certain mbstring functions to convert multibyte e…9.1
• CVE-2020-7061In PHP versions 7.3.x below 7.3.15 and 7.4.x below 7.4.3, wh…9.1
• CVE-2020-7062In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15 and 7…7.5
• CVE-2020-7063In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15 and 7…5.3
• CVE-2020-7064In PHP versions 7.2.x below 7.2.9, 7.3.x below 7.3.16 and 7.…5.4
• CVE-2020-7065In PHP versions 7.3.x below 7.3.16 and 7.4.x below 7.4.4, wh…8.8
• CVE-2020-7067In PHP versions 7.2.x below 7.2.30, 7.3.x below 7.3.17 and 7…7.5
• CVE-2020-7068In PHP versions 7.2.x below 7.2.33, 7.3.x below 7.3.21 and 7…3.6
• CVE-2020-7069In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7…6.5
• CVE-2020-7070In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7…5.3
• CVE-2020-7071In PHP versions 7.3.x below 7.3.26, 7.4.x below 7.4.14 and 8…5.3
• CVE-2020-7079An improper signature validation vulnerability in Autodesk D…7.8