BIT-libphp-2020-7066

See a problem?

Import Source

https://github.com/bitnami/vulndb/tree/main/data/libphp/BIT-libphp-2020-7066.json

JSON Data

https://api.osv.dev/v1/vulns/BIT-libphp-2020-7066

Aliases

Published

2025-08-11T13:53:09Z

Modified

2026-09-08T08:48:07Z

Summary

get_headers() silently truncates after a null byte

Details

In PHP versions 7.2.x below 7.2.29, 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while using get_headers() with user-supplied URL, if the URL contains zero (\0) character, the URL will be silently truncated at it. This may cause some software to make incorrect assumptions about the target of the get_headers() and possibly send some information to a wrong server.

Database specific

{
    "cpes": [
        "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*"
    ],
    "severity": "Medium"
}

References

Affected packages

Bitnami / libphp

Package

Name: libphp
Purl: pkg:bitnami/libphp

Severity

4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N CVSS Calculator

Affected ranges

Type: SEMVER
Events: Introduced

7.2.0

Fixed

7.2.29

Introduced

7.3.0

Fixed

7.3.16

Introduced

7.4.0

Fixed

7.4.4

Database specific

source

"https://github.com/bitnami/vulndb/tree/main/data/libphp/BIT-libphp-2020-7066.json"